>it would be trivial to add a service that would sign challenges to prove so

If the author was being dishonest about the key, they could just keep the key on another secure server and have the vulnerable one forward the challenge requests to it.