Z-11/12 indeed. And maybe signature verification somewhere, but not sure where. It should be done both in relay and client.