In theory, you could do an out-of-band comparison. In practice, you'd generally accept that the first one you receive is valid, and then watch for deviations f

In theory, you could do an out-of-band comparison. In practice, you'd generally accept that the first one you receive is valid, and then watch for deviations from there. This is the way SSH works, for instance.