I'd like to know as well. There could very well be some auditing requirement that forces them to explicitly generate the tokens sent to users, and the people en

I'd like to know as well. There could very well be some auditing requirement that forces them to explicitly generate the tokens sent to users, and the people enforcing the requirement have sticks up their asses. It wouldn't be the first time that the auditors foul up something because despite working as well or better than what they want, it's not what they know.