I don't think they need to be separate modules for it to be difficult to screw it up. For example verification can be implemented by making the user pass in an instance of a class that must implement a specific interface, and we can then provide only sensible secure implementations of that without making it hard for the user to plugin something like the monkeysphere/retroshare model, DANE or TACK.