The submission handler should handle also invalid credentials and protocols, processing the measurements, but signaling to the caller that it's going to get marked as not verified.

See: https://github.com/ooni/userauth/pull/32/changes