MAKING CERTAIN AUTHENTICITY: HOW KMS PICO VERIFICATION OPERATES