Local pilot. Checks must actually be performed; checking a box is not verification.
Send a short-lived code to the verified administrator email. The permanent key is never emailed.