evenflow,
Tom Derby is a well known "authority" in the hobby. Many people go to him for COA's as he has a highly regarded reputation, in part due to his ownership in Cloud City Collectibles. I can't say if that COA is legitimate or not, but if you have concerns about it I'm sure you could send Tom an email through CC to ask. Also you could check out AFA and the number provided to verify that they did in fact grade this figure if you're concerned about that as well.