For sure - that message should be via whatever the secure channel for support happens to be, if someone is going this route. I appreciate someone doing something a bit more robust than “tweet at us and promise you are you who say you are”