code: func (constraints *tokenConstraints) verify(kid, alg, header, payload, signature string) (err error) {
  	// Construct the payload
  	plaintext := []byte(header)
  	plaintext = append(plaintext, []byte(".")...)
  	plaintext = append(plaintext, payload...)
  	// Look up the algorithm
  	var ok bool
  	var a tokenAlgorithm
  	a, ok = tokenAlgorithms[alg]
  	if !ok {
  		err = fmt.Errorf("unknown JWS algorithm: %s", alg)
  		return
  	}
  	// If we're configured with a single key then only trust that
  	if constraints.key != nil {
  		return a.verify(constraints.key, a.hash, plaintext, []byte(signature))
  	}
  	if constraints.secret != "" {
  		return a.verify([]byte(constraints.secret), a.hash, plaintext, []byte(signature))
  	}
  	// (*tokenConstraints)validate() should prevent this happening
  	err = errors.New("unexpectedly found no keys to trust")
  	return
  }
docs: // verify verifies a JWT using the constraints and the algorithm from the header