code: function findResponder(issuer, certs, raws) {
    var issuerKey = issuer.tbsCertificate.subjectPublicKeyInfo;
    issuerKey = ocsp.utils.toPEM(
      rfc5280.SubjectPublicKeyInfo.encode(issuerKey, 'der'), 'PUBLIC KEY');
  
    for (var i = 0; i < certs.length; i++) {
      var cert = certs[i];
      var signAlg = ocsp.utils.sign[cert.signatureAlgorithm.algorithm.join('.')];
      if (!signAlg) {
        throw new Error('Unknown signature algorithm ' +
          cert.signatureAlgorithm.algorithm);
      }
  
      var verify = crypto.createVerify(signAlg);
  
      verify.update(raws[i]);
      if (!verify.verify(issuerKey, cert.signature.data))
        throw new Error('Invalid signature');
  
      var certKey = cert.tbsCertificate.subjectPublicKeyInfo;
      certKey = ocsp.utils.toPEM(
        rfc5280.SubjectPublicKeyInfo.encode(certKey, 'der'), 'PUBLIC KEY');
      return certKey;
    }
  
    return issuerKey;
  }
docs: TODO(indutny): verify issuer, etc...