i.e. the evidence could be a credential we are verifying, or it could be some other form of evidence the realm can verify against the stored credentials.