Custom domains for MENA SaaS: setup to safe removal

A customer's branded portal can load over HTTPS and still be attached to the wrong workspace. A certificate answers a domain-control question. Your application must separately decide which tenant may