docs: def ValidateIapJwt(iap_jwt, expected_audience):
    """Validates an IAP JWT."""
  
    try:
      key_id = jwt.get_unverified_header(iap_jwt).get("kid")
      if not key_id:
        raise IAPValidationFailedError("No key ID")
      key = GetIapKey(key_id)
      decoded_jwt = jwt.decode(
          iap_jwt, key, algorithms=["ES256"], audience=expected_audience)
      return (decoded_jwt["sub"], decoded_jwt["email"])
    except (jwt.exceptions.InvalidTokenError,
            requests.exceptions.RequestException) as e:
      raise IAPValidationFailedError(e)