How can the recipient of an XHE validate the integrity of an external payload referenced from the XHE?