code: def verify_sig(signed_request, secret, issuer=None, algorithms=None,
                 expected_aud=None):
      
      if not issuer:
          issuer = _get_issuer(signed_request=signed_request)
      signed_request = _to_bytes(signed_request)
      app_req = _get_json(signed_request)
  
      # Check signature.
      try:
          jwt.decode(signed_request, secret, verify=True,
                     algorithms=algorithms, audience=expected_aud)
      except jwt.ExpiredSignatureError, exc:
          _re_raise_as(RequestExpired, '%s' % exc, issuer=issuer)
      except jwt.InvalidTokenError, exc:
          _re_raise_as(InvalidJWT,
                       'Signature verification failed: %s' % exc,
                       issuer=issuer)
      return app_req
docs: Verify the JWT signature.
  
      Given a raw JWT, this verifies it was signed with
      *secret*, decodes it, and returns the JSON dict.