That's correct, but it's also trivial for you to ban the whole domain, so it's a bit of an improvement over naked pubkeys.