Cannot Verify Email via Application Initiated Enrollment

If ApiSource is used to trigger an Enrollment Flow with Email Confirmation enabled, no email address is flagged verified because both the Org Identity Email Address and the CO Person Email Address created via the Pipeline are read only.

Probably the CO Person copy should be flagged as verified (and the Pipeline code will have to be careful to not unverify if the Email Address hasn't changed), though maybe (more generally) the CO Person pipelined attributes should be read/write (with a warning that values may be reset)?