Yeah, verification is needed. A malicious gateway can be passed in via env for example. There should be another optional argument that also verifies the conten

Yeah, verification is needed. A malicious gateway can be passed in via env for example. There should be another optional argument that also verifies the contents vs the hash.