Exactamento. It's basically a challenge and response. If I receive the challenge via a signed/encrypted DM then that is equivalent to the typical challenge and signed response. If you wish, you could add your own timeout, but that would be outside of the protocol spec, more like good practice guidance.