code: func filterByTag(c context.Context, page []*datastore.Key, tag *api.Tag) ([]*datastore.Key, error) {
  	tagID := TagID(tag)
  	tagEnts := make([]*Tag, len(page))
  	for i, inst := range page {
  		tagEnts[i] = &Tag{
  			ID:       tagID,
  			Instance: inst,
  		}
  	}
  	existing, _, err := fetchTags(c, tagEnts, func(int) *api.Tag { return tag })
  	if err != nil {
  		return nil, errors.Annotate(err, "failed by filter by tag %q", common.JoinInstanceTag(tag)).Err()
  	}
  	filtered := page[:0]
  	for _, tagEnt := range existing {
  		filtered = append(filtered, tagEnt.Instance)
  	}
  	return filtered, nil
  }
docs: // filterByTag takes keys of Instance entities and keeps only ones that have the
  // given tag attached (preserving the order).
  //
  // Fetches the tags to verify their Tag fields really match 'tag' as a safeguard
  // against malicious SHA1 collision on TagID.