Paste both public keys, compute the combined safety number, then read it aloud to each other over a channel you trust (a phone call, in person). If it matches on both sides, nobody swapped a key in transit. Paste one key alone to get just its fingerprint.

Your public key Their public key

SHA-512/256 over the key, entirely in your browser (connect-src 'none'). This confirms two parties hold the same key — it does not prove a key belongs to a particular person.