code: public boolean verify(GoogleIdToken googleIdToken) throws GeneralSecurityException, IOException {
      // check the payload
      if (!super.verify(googleIdToken)) {
        return false;
      }
      // verify signature, try all public keys in turn.
      for (PublicKey publicKey : publicKeys.getPublicKeys()) {
        if (googleIdToken.verifySignature(publicKey)) {
          return true;
        }
      }
      return false;
    }
docs: Verifies that the given ID token is valid using the cached public keys.
  
  It verifies:
  
  <ul>
  <li>The RS256 signature, which uses RSA and SHA-256 based on the public keys downloaded from
  the public certificate endpoint.</li>
  <li>The current time against the issued at and expiration time (allowing for a 5 minute clock
  skew).</li>
  <li>The issuer is {@code "accounts.google.com"} or {@code "https://accounts.google.com"}.</li>
  </ul>
  
  @param googleIdToken Google ID token
  @return {@code true} if verified successfully or {@code false} if failed