Wait... Naive question: shouldn't you, especially in this case, still nag the account owner about his own unverified sessions? What if a bad-actor homeserver slides in a new session to snoop around?
BTW: I absolutely love the cross-signing move and riot/matrix in general! :) Thanks for your great work on this!
BTW: I absolutely love the cross-signing move and riot/matrix in general! :) Thanks for your great work on this!