Comment by mrexcess

True but the out of band secure channel could just be something like DNS, automated and constantly subject to distributed monitoring for deltas.