Server side only stores thumbprint.