docs: function _verifyJws(jws) {
      var encodedPayload = base64url(jws.payload);
  
      /*
       * Disallow the "none" algorithm because while the `jws` module might have
       * a guard against
       *      // JSSTYLED
       *      https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
       * why bother allowing it?
       */
      var disallowedAlgs = ['none'];
  
      for (var i = 0; i < jws.signatures.length; i++) {
          var jwsSig = jws.signatures[i];
          var alg = jwsSig.header.alg;
          if (disallowedAlgs.indexOf(alg) !== -1) {
              throw new errors.ManifestVerificationError(
                  {jws: jws, i: i}, 'disallowed JWS signature algorithm:', alg);
          }
  
          // TODO: Find Docker manifest example using 'header.chain'
          // and implement this. See "jsonsign.go#Verify".
          if (jwsSig.header.chain) {
              throw new errors.InternalError({jws: jws, i: i},
                  'JWS verification with a cert "chain" is not implemented: %j',
                  jwsSig.header.chain);
          }
  
          // `mod_jws.verify` takes the JWS compact representation.
          var jwsCompact = jwsSig['protected'] + '.' + encodedPayload +
              '.' + jwsSig.signature;
          var verified = mod_jws.verify(jwsCompact, alg, jwsSig.header.jwk);
          if (!verified) {
              throw new errors.ManifestVerificationError(
                  {jws: jws, i: i}, 'JWS signature %d failed verification', i);
          }
      }
  }