Optional
Bind the link to one opener (e.g. recipient JID); rejected for anyone else.
One-time token to embed (pair with a NonceStore on the verify side).
Bind the link to one opener (e.g. recipient JID); rejected for anyone else.