For IDN names, there are 2 different times:
1. registration time
2. lookup time
You do not quote the two most important ones:
0. standardization
3. the user click.
The standardization will most probably adapt through a grassroots process.
The problem today is not what the users read, but the difference between
what the users do and what they believe they do when they click.
As I told you in a more detailed comment, you will no change the Unicode
system for the reasons Doug Ewell explained. But you can conceive a namemap
function which will transcode the characters of the URL that the user
clicks into the characters he thinks he clicks/he wants to click. Obviously
you can run the function twice (the first time to indicate where a change
would occur if clicked).
1. there is no problem then to signal that a character has been changed, or
to have a choice if there are several possibilities
2. if the correction works and reaches paypal, there is no problem.
Otherwise it will not work. So the security is protected.
This permits the user to decide of his own security. This is an anti-virus,
an antispam approach.
jfc