What's the most secure way to verify the domain ownership ?

You need to monitor the whois record for this domain for changes. You can do this manually or there are services out there, including godaddy, that offer domain monitoring services and will email you if the whois info changes.

Well you used to be able to do this by asking the seller to change the who is, that wasn't perfect, but it was one useful method. I understand that the new rules mean that this would cause the name to be locked, and thus the transfer would be blocked.

I think the OP was just wanting to check ownership of the domain and know if ownership were to change in the future. Monitoring the whois would accomplish this.

If it is a matter of verifying ownership of the domain, and the OP is in contact with the domain owner, then the OP could request the domain owner to create a TXT record in the DNS as an alternate method to prove ownership (or at least control).

Again, I am not entirely certain what the OP was trying to accomplish - but the two methods mentioned above should accomplish their needs hopefully.

But a domain could have the Whois privacy enabled, i don't think monitoring the Whois a fantastic solution

Short of whois, DNS records, or a physical file hosted on a server - there is no other way to verify ownership/control of a domain. Email verification would be another option, but that would only prove they had an email account at that domain unless it is a contact on the whois record.

The problem of physical file hosted is that if you move the site the file will be automatic transfered to the new owner. I want if someone transfert the domain he lose the ownership....probably the best way is the txt record in dns, that are not transferred with the domain, but i think with a domain push the record is transferred.