locallyValidate() is expensive -- stop doing it on every HELLO since in most cases we already know the identity and know it is valid