They can create a 2 of 2 multisig address. To withdraw funds signature from both alice and bob are needed.
Both parties send their public key to each other and create a 2 of 2 multisig address with their key and the key that they got. If they got the same address they can continue. Bitcoin is deposited in the address , service is provided. If service is satisfactory service taker signs the tx of the service provider. Deal is done. Sorry if you got confused. You can google about multisig address.
I still do not get the point:
Lets say Alice wants to buy example.com from Bob for 1 BTC.
They create a 2 of 2 multisig adress.
Now there are two possible steps ...
Possibility 1: Alice deposits 1 BTC to adress and signs the tx.
As soon as Bob confirms he has the 1 BTC without sending the AuthCode and is still in control of the domain name.
This is unsecure.
Possibility 2: Alice deposits 1 BTC to adress and does not sign the tx.
Bob sends the AuthCode to Alice. As soon as Alice gets the AuthCode, she can run away with the domain name without signing.
This is unsecure.
Maybe you could clear things further.
Thanks,
Bitone