In order to be successfully verified, every mirror zone is currently required to be configured with at least one trust anchor that has the SEP bit set. This requirement brings no security benefit and thus should be relaxed.