I have identified a cons: the user cannot verify that the url matches their public key. But how many people remember the hex?