Never trust an incoming message on any platform.
On that note: I just performed my hardware key check on casa , you have to approve a key on your hardware devise but have nothing to compare that key to . It was scary.