this uses a verification requests as emitted by the js-sdk with
the `crypto.verification.request` rather than a verifier as emitted
by `crypto.verification.start` as this works for both to_device and
timeline events with the changes made in the js-sdk pr.