It was “trusted” input, they validated the signature and everything.