In the current state, it's basically just a self verification. When you use a new device it shows a series of emoji on each device and asks you if they're the same, then the device is verified.

You can also use a generated security key to verify as a type of second-factor.