code: func (cgs *credentialGraphSet) Active() ([]registry.CredentialGraph, error) {
  	active := make([]registry.CredentialGraph, 0, len(cgs.graphs))
  
  	for _, graphs := range cgs.graphs {
  
  		// parents is the slice of IDs already seen in Previous fields.
  		// they cannot be active as they have been overwritten.
  		var parents []identity.ID
  
  		sort.Sort(graphSorter(graphs))
  		for headOffset, graph := range graphs {
  			var activeCreds []envelope.CredentialInf
  			var err error
  			activeCreds, parents, err = cgs.activeCreds(parents, graph)
  			if err != nil {
  				return nil, err
  			}
  
  			// the most recent version of a keyring is always active
  			// (it could be filled entirely with unset values)
  			if len(activeCreds) > 0 || headOffset == 0 {
  				active = append(active, graph)
  			}
  		}
  	}
  
  	return active, nil
  }
docs: // Active returns a slice of CredentialGraphs that contain credentials that
  // are still reachable.
  // A credential is reachable if a newer version of the CredentialGraph has not
  // replaced its value, and it is not an `unset` Credential.