notice how the whole identity depends on outside validation?