Verifying the fingerprint out-of-band is very much what is meant to happen, but it's like reading the EULA, everyone knows that you should do it, everyone knows that very very few people do.