Checks every signature against the group's public key, in your browser. The group key is published; nothing here trusts the server. A tampered payload or a wrong key fails.