add -trusted_first option and verify flag