This was my immediate thought as well. Though I have not thought through any of the details, it did occur to me that the information needed would be in the "source" section of the header. I wonder if it is too much work to validate it somehow before using it?

I haven't ever done any programming at this layer of the stack, so I'm purely spitballing.