code: func tokenConstraintCert(value ast.Value, constraints *tokenConstraints) (err error) {
  	var cert ast.String
  	var ok bool
  	if cert, ok = value.(ast.String); !ok {
  		err = fmt.Errorf("cert constraint: must be a string")
  		return
  	}
  	if constraints.key, err = getKeyFromCert(string(cert)); err != nil {
  		return
  	}
  	return
  }
docs: // tokenConstraintCert handles the `cert` constraint.