Is it possible to impersonate an identity?

I have a question over whether it's possible to impersonate an identity,
say, alice@example.com

If I have understood correctly web payments identities will be compatible
with Persona / BrowserID

Does this mean they will look up .well-known/browserid in example.com and
if not fall back to the mozilla server?  Would that mean that mozilla could
then impersonate Alice?

Just thinking out loud, I might have misunderstood the flow here ...