This is anticipating having the bridge under the same domain as the keyserver, but also gives us flexibility in where/how we host the bridge, since it won't be hardcoded in the email. In production, one could imagine the load balancer redirecting this route before it touches hapi.

The bridge will still proxy or use cors to send the verification request.