maybe add as part of the example, "traditionally this is a signed response from the servers CA that would need to be validated"