seems like the client verifies them