docs: def get_subject_with_local_validation(jwt_bu64, cert_obj):
      """Validate the JWT and return the subject it contains.
  
      - The JWT is validated by checking that it was signed with a CN certificate.
      - The returned subject can be trusted for authz and authn operations.
  
      - Possible validation errors include:
  
          - A trusted (TLS/SSL) connection could not be made to the CN holding the
            signing certificate.
          - The JWT could not be decoded.
          - The JWT signature signature was invalid.
          - The JWT claim set contains invalid "Not Before" or "Expiration Time" claims.
  
      Args:
        jwt_bu64: bytes
          The JWT encoded using a a URL safe flavor of Base64.
  
        cert_obj: cryptography.Certificate
          Public certificate used for signing the JWT (typically the CN cert).
  
      Returns:
        - On successful validation, the subject contained in the JWT is returned.
  
        - If validation fails for any reason, errors are logged and None is returned.
  
      """
      try:
          jwt_dict = validate_and_decode(jwt_bu64, cert_obj)
      except JwtException as e:
          return log_jwt_bu64_info(logging.error, str(e), jwt_bu64)
      try:
          return jwt_dict['sub']
      except LookupError:
          log_jwt_dict_info(logging.error, 'Missing "sub" key', jwt_dict)