Authentication when adding issuer

Chris Jagers’ article:

https://medium.com/learning-machine-blog/the-new-blockcerts-mobile-app-eea18053f526

says,

Additional security measures can be added as well. For instance, MIT added an additional authentication layer. To successfully add MIT as an issuer, students must also enter their MIT Campus credentials into their student ID system called Touchstone. This is a great example of the fundamental flexibility of Blockcerts to support how institutions establish the identity of their recipients.

How does that authentication layer work?

Is it a check that is done separately from the Wallet?

Or is the authentication somehow built into the Wallet itself?