What procedure to use to verify a raw public key (TLS ECDHE_EDCSA ciphersuite)? Contrary of verifying a certificate which is a well-known procedure, I am wondering what the procedure is to verify a raw public key 'certificate' (https://tools.ietf.org/html/rfc7250). This certificate, as a matter of fact, does not carry any signature.
It is outside the scope of TLS and must be arranged out of band.

Raw public keys come without any signatures and cannot be verified without additional knowledge. Section 1 of the RFC mentions a few ways how they might be verified in some situations. They all amount to receiving the public key through some other authenticated channel.


  
  The TLS client can obtain the TLS server public key from a DNSSEC-
    secured resource record using DNS-Based Authentication of Named
    Entities (DANE) [RFC6698].
  The TLS client or server public key is obtained from a [PKIX]
    certificate chain from a Lightweight Directory Access Protocol
    [LDAP] server or web page.
  The TLS client and server public key is provisioned into the
    operating system firmware image and updated via software updates.