Anyone can write any contract address on any website. The deployer wallet therefore signs a statement naming this exact domain and contract address, published at /.well-known/solana-ca.json in the open solana-ca-binding/v1 format, verifiable offline.
It proves the site is authorised by the token's deployer. It does not prove the project is good or safe — judge the evidence, not the existence of the file.