Blossom hosts media by SHA-256 hash. When a stream URL is a Blossom blob, the client tries the author's URL first, then your servers below, then servers published in your kind:10063 event, then the built-in defaults. If verification can't be completed (CORS, offline), the URL is played directly and marked unverified.