A network engineer is configuring a standards-based site-to-site IPsec VPN between two branch routers. During IKEv2 negotiation, the engineer must ensure both peers can mutually verify each other's identity before establishing the secure channel, but the organization has decided not to deploy a PKI. Which cryptographic component fulfills the peer authentication requirement in this deployment?