I would like to ask a question a little bit similar to How exactly can someone prove they were the creator of an NFT?
In this scenario, the NFT is already minted. According to the description of the ERC721 standard, it does hold an URI (web or IPFS, not relevant for this example) that contains metadata of this NFT.
My question is, given this metadata, how one can prove it was written by the same party as the issuer of the NFT? I was trying to find some sort of signature field in the metadata format description written in the EIP-721 standard document but I could not get my answer.
My motivation is, I imagine an attack that is especially threatening if the URI is just a weblink (thus metadata content becomes mutable). A third party could inject fake metadata JSON object by a sort of man-in-the-middle attack. Without issuer signature, the receiver is not able to prove the metadata originates from the issuer of the NFT.
I think I must be missing something. Any clarification appreciated!