Sounds good in theory, but you still need to verify each person corresponds to specific public key, right?