when no validation is attempted, trust level is 'bad'
when validation attempted but insecure, trust level is 'insecure'
otherwise 'secure'