Has the owner answered that verification email yet?

One word — pending, verified, issued, cancelled — about one sign-up, so a page that has just sent somebody an email can finish the job itself instead of asking them to press a button again when they get back.

It has no side effects. It mints nothing, mails nothing, verifies nothing and consumes nothing, and it is not a step in getting a key: the key still comes from create_account, after the owner confirms the request on the page the email links to, once. This only says when that call is worth making.

It never returns an address. The token is a public id, and a public id is handed out by existing_account, so an address here would undo that answer's redaction.

No key. The token is the account.id that create_account returned with pending_verification, which the caller that started the sign-up holds and nobody else does.

Poll every poll_after_seconds. This has its own budget — thirty checks a minute per token — so polling here never spends the three-per-hour create_account budget, which is the whole reason it exists.