Hi.
Currently, pidgin only stores and verifies the user@host part of a JID in XMPP-based protocols in the ~/.purple/otr.fingerprints file.
E.g.:
foo@… bar@…/Mobile prpl-jabber adfe384759294857366529497462648590373263 verified
The resource-part is missing (note that it _does_ include the resource-part on the sending account).
Quite obviously this is both a technical and a security problem:
1) Technical:
It's very likely that when people use different devices, they will also use different keys, which now is a problem.
2) Security:
It's not really possible to specify to expect which key on which resource.
Cheers,
Chris.