I'd be careful about grabbing the most recently updated attempt and assuming it represents the state of the user. Between changing configuration, errors, and callbacks from Software Secure, I suspect we could get into funny states. When figuring out if someone needs to reverify themselves, can we leverage the other class methods (so check that it's not the case that `user_has_valid_or_pending`) and explicitly look for a failed certificate verification?