The logic for pulling it is not that it's truly an external interface per se, but rather that if we think it'll be painful to test in place, that's a sort of "code smell" that indicates that object is growing too big to be easily maintainable.  The reason to pull it out (a la the "humble object" pattern) would be specifically to make it easier to test (in part by allowing more of the tests to be synchronous) and possibly even improve separation of concerns.

Keeping it as an internal function is ok too, but if we want to do that, we'll need to re-write the signin tests to cover the verifier function before we throw it out (if we throw it out, there will be zero coverage, because it's stubbed in all the current tests).

Whichever way you want to take it forward, I propose using an XXX comment to document what needs to be done in order to keep this card from getting bigger.