If you really want to verify the other end and if asking them to do something is allowed, you can ask them to any number of things, isn't it? The key is to not

If you really want to verify the other end and if asking them to do something is allowed, you can ask them to any number of things, isn't it? The key is to not turning it into a protocol. That will ensure it gets built into the software.