verify_pubkey() now takes a ref