Returns a validated descriptor to trusted identity/recovery services. It can contain private material.