Comment by lixtra

According to parents nice talk[1] you can add a verify switch that lets you compare the signature of the actual key. So a public authenticated channel is enough.

[1] https://youtu.be/oFrTqQw0_3c