Right now, all requests require a callback with a token. user [email protected] sends a request to [email protected] with a generated token. [email protected] then sends a verification request back with that token to [email protected], and [email protected] sends back true, and [email protected] completes the request.

Which, if I'm not mistaken, is very similar to how XMPP does it.

The protocol also tries and minimizes the amount of actions that a third party node can take. You only trust your own node to take actions on your behalf.