Isn’t that a common practice?

I don’t know what stated on the letter that your boss signed, but whatever it is, your boss must bear responsibilities to what he signed on the letter if anything happened.

How can the Embassy prove that the person who signed the letter an actual person?

You boss could provide a copy of his passport and perhaps signed on the copy that it’s for only the visa purpose.