Verify ownership of the OpenPGP fingerprint before approving any identity bootstrap. Fingerprints alone aren't proof of control; require a signed assertion from the key owner and cross-check against a trusted keyring or another verification channel. This keeps bootstrap from being hijacked by impostors. If you cannot verify ownership, hold the approval.