we already return handle, pds and signing_key in GET /repos so most of this is done but we need to bi-directionally verify the handle which we dont right now.