I just realized that my first example has a flaw in it. An error returned by verify_zendesk_origin(conn) will be mapped to :invalid_origin. Next subsequent calls to map_error will convert it to a %ChangesetError{}, which isn’t what we wanted. You need to go with the snippet #3 to avoid this.
Pattern matching on %Ecto.Changeset{} in these anonymous functions passed to map_error would quickly show the culprit and possibly make the pipeline easier to grasp.