code: func (i *Inspector) checkSignature(c context.Context, unwrapped *Unwrapped) (string, error) {
  	certsBundle, err := i.Certificates.Certificates(c)
  	if err != nil {
  		return "", transient.Tag.Apply(err)
  	}
  	cert, err := certsBundle.CertificateForKey(unwrapped.KeyID)
  	if err != nil {
  		return fmt.Sprintf("invalid signing key - %s", err), nil
  	}
  	withCtx := prependSigningContext(unwrapped.Body, i.SigningContext)
  	err = cert.CheckSignature(x509.SHA256WithRSA, withCtx, unwrapped.RsaSHA256Sig)
  	if err != nil {
  		return fmt.Sprintf("bad signature - %s", err), nil
  	}
  	return "", nil
  }
docs: // checkSignature verifies the signature of the token.
  //
  // Returns "" if the signature is correct, or an invalidity reason if it is not.