code: func builtinJWTVerifyHS256(a ast.Value, b ast.Value) (ast.Value, error) {
  	// Decode the JSON Web Token
  	token, err := decodeJWT(a)
  	if err != nil {
  		return nil, err
  	}
  
  	// Process Secret input
  	astSecret, err := builtins.StringOperand(b, 2)
  	if err != nil {
  		return nil, err
  	}
  	secret := string(astSecret)
  
  	mac := hmac.New(sha256.New, []byte(secret))
  	_, err = mac.Write([]byte(token.header + "." + token.payload))
  	if err != nil {
  		return nil, err
  	}
  
  	signature, err := token.decodeSignature()
  	if err != nil {
  		return nil, err
  	}
  
  	return ast.Boolean(hmac.Equal([]byte(signature), mac.Sum(nil))), nil
  }
docs: // Implements HS256 (secret) JWT signature verification