ok: A has no PIN initially
ok: A now has a PIN
ok: B now has a PIN
ok: A verifies with shared PIN under A's id
ok: B verifies with shared PIN under B's id
ok: wrong PIN for A fails
ok: old PIN for A no longer works after rotate
ok: new PIN for A works after rotate
ok: deactivated user's PIN fails verify
DONE