Clients and server can verify locally or delegate