Turns out "don't trust, verify