Say I have a game, when you finish playing you put your name in and your score is synched with a public scoreboard. Assume also that I own the server and its code. How can I verify that the scores received by public clients are legitimate and not fake?
Malicious use-case: I play the game, then I open burp and capture the packet to the server. I change the score to be 9999999 and forward the packet.
How can I prevent this?
Welcome to the ever evolving topic of anti-cheating measures. It's a cat and mouse game of ever evolving controls and circumventions. You're right, functionally anyone can sign anything. Having a client report their score is a recipe for disaster.
In many cases, the server is is the one that does the score calculation, it's much harder to hack a server than one's own game.
In competitive settings, notable scores often require a recording (see speedrunning).
If you wanted a cryptography solution, one might chain every action taken in the game to the previous action cryptographically. Random judges could then verify no illegal moves and sign the score. I guess that would be blockchain gaming, and you can have that idea for free.
