docs: def VerifyMessageSignature(self, response_comms, packed_message_list, cipher,
                               cipher_verified, api_version, remote_public_key):
      """Verifies the message list signature.
  
      In the server we check that the timestamp is later than the ping timestamp
      stored with the client. This ensures that client responses can not be
      replayed.
  
      Args:
        response_comms: The raw response_comms rdfvalue.
        packed_message_list: The PackedMessageList rdfvalue from the server.
        cipher: The cipher object that should be used to verify the message.
        cipher_verified: If True, the cipher's signature is not verified again.
        api_version: The api version we should use.
        remote_public_key: The public key of the source.
  
      Returns:
        An rdf_flows.GrrMessage.AuthorizationState.
      """
      if (not cipher_verified and
          not cipher.VerifyCipherSignature(remote_public_key)):
        stats_collector_instance.Get().IncrementCounter(
            "grr_unauthenticated_messages")
        return rdf_flows.GrrMessage.AuthorizationState.UNAUTHENTICATED
  
      try:
        client_id = cipher.cipher_metadata.source.Basename()
        metadata = data_store.REL_DB.ReadClientMetadata(client_id)
        client_time = packed_message_list.timestamp or rdfvalue.RDFDatetime(0)
        update_metadata = True
  
        # This used to be a strict check here so absolutely no out of
        # order messages would be accepted ever. Turns out that some
        # proxies can send your request with some delay even if the
        # client has already timed out (and sent another request in
        # the meantime, making the first one out of order). In that
        # case we would just kill the whole flow as a
        # precaution. Given the behavior of those proxies, this seems
        # now excessive and we have changed the replay protection to
        # only trigger on messages that are more than one hour old.
        if metadata and metadata.clock:
          stored_client_time = metadata.clock
  
          if client_time < stored_client_time - rdfvalue.Duration("1h"):
            logging.warning("Message desynchronized for %s: %s >= %s", client_id,
                            stored_client_time, client_time)
            # This is likely an old message
            return rdf_flows.GrrMessage.AuthorizationState.DESYNCHRONIZED
  
          # Update the client and server timestamps only if the client time moves
          # forward.
          if client_time < stored_client_time:
            logging.warning("Out of order message for %s: %s > %s", client_id,
                            stored_client_time, client_time)
            update_metadata = False
  
        stats_collector_instance.Get().IncrementCounter(
            "grr_authenticated_messages")
  
        for label in data_store.REL_DB.ReadClientLabels(client_id):
          stats_collector_instance.Get().IncrementCounter(
              "client_pings_by_label", fields=[label.name])
  
        if not update_metadata:
          return rdf_flows.GrrMessage.AuthorizationState.AUTHENTICATED
  
        source_ip = response_comms.orig_request.source_ip
        if source_ip:
          last_ip = rdf_client_network.NetworkAddress(
              human_readable_address=response_comms.orig_request.source_ip)
        else:
          last_ip = None
  
        data_store.REL_DB.WriteClientMetadata(
            client_id,
            last_ip=last_ip,
            last_clock=client_time,
            last_ping=rdfvalue.RDFDatetime.Now(),
            fleetspeak_enabled=False)
  
      except communicator.UnknownClientCertError:
        pass
  
      return rdf_flows.GrrMessage.AuthorizationState.AUTHENTICATED