code: func checkExpiration(body *tokenserver.MachineTokenBody, now time.Time) error {
  	notBefore := time.Unix(int64(body.IssuedAt), 0)
  	notAfter := notBefore.Add(time.Duration(body.Lifetime) * time.Second)
  	if now.Before(notBefore.Add(-allowedClockDrift)) {
  		diff := notBefore.Sub(now)
  		return fmt.Errorf("token is not valid yet, will be valid in %s", diff)
  	}
  	if now.After(notAfter.Add(allowedClockDrift)) {
  		diff := now.Sub(notAfter)
  		return fmt.Errorf("token expired %s ago", diff)
  	}
  	return nil
  }
docs: // checkExpiration returns nil if the token is non-expired yet.
  //
  // Allows some clock drift, see allowedClockDrift.