Hi:
I tend to fall into the camp that believes when you have any intermediary you weaken security - also I am queasy about self signed certificates.
I would put my vote clearly behind C (transfer target from cc-transfer) directly contacts A (transferor in cc-transfer) and asking for verification. This was shown as VERIFY in Roberts slides - and may I suggest that we use NEGOTIATE as the method that does this verification check.
Thanks,
Sriram