code: func mutualTLSBinding(ctx context.Context, claimedTLScertHash []byte) error {
  	if len(claimedTLScertHash) == 0 {
  		return errors.Errorf("client didn't include its TLS cert hash")
  	}
  	actualTLScertHash := ExtractCertificateHashFromContext(ctx)
  	if len(actualTLScertHash) == 0 {
  		return errors.Errorf("client didn't send a TLS certificate")
  	}
  	if !bytes.Equal(actualTLScertHash, claimedTLScertHash) {
  		return errors.Errorf("claimed TLS cert hash is %v but actual TLS cert hash is %v", claimedTLScertHash, actualTLScertHash)
  	}
  	return nil
  }
docs: // mutualTLSBinding enforces the client to send its TLS cert hash in the message,
  // and then compares it to the computed hash that is derived
  // from the gRPC context.
  // In case they don't match, or the cert hash is missing from the request or
  // there is no TLS certificate to be excavated from the gRPC context,
  // an error is returned.