http://dnbible7sqskwppgaqohboxz7u5kzffjzdx3lxzpjtt3s6tzeiytb5ad.onion/bible/communication-methods/jabberxmpp/using_jabber/index.html
So if you are sure that the message (where he told you his XMPP username) that the other user sent you could not be manipulated, then you can skip the authentication / verification. If however you received the username through for example a clear text message on a DNM, this message may have been tampered with by LE who might have taken over the market.