Wouldn't be hard for him to follow up with "to prove it was you, sign X with the sending private key" if there are multiple claims.