The answer is the first choice. Alice needs to validate--sorry.
My answer is the first choice. The bank needs to validate the hashes.
It needs to know the preimage for the hash. It's enough to get just one of those.
It isn't necessary to get both of them because the bank presumably starts knowing Alice's identity.
If the bank doesn't start knowing Alice's identity,
then anyone could create a bill that would blame Alice for double spending.
So if the banks knows Alice's identity, then the bank can compute the other part of this
computing xk1 by XORing this value with Alice's identity
and they can check if both of the hashes are correct.
If they are, that validates that each of these identity components is correct.
