QR code based verification doesn't verify a device when users are verifying each other, generalize the logic that marks stuff as verified so we can verify either only a device or an user identity or both.