The empty value marks a legacy key from before user verification existed; such keys are rejected at login and must be re-enrolled.