pull down to refresh

No, their client only connects to their own server by default and the server crawls relays and caches notes. I assume they verify signatures there.

The problem is that Primal controls the server so they could fake notes from anyone.