The user part of the authority can still be trusted though, it's just the app part which is untrusted. Note that "unregistered application" is only allowed with "known user"