add todo comment for host-verification