@thisismissem @trwnh doesn't have to be either-or. Can be also-and. Use sender-provided metadata, and possibly re-verify with a trusted API.