code: func NewVerifyStream(versionValidator VersionValidator, r io.Reader, keyring SigKeyring) (skey SigningPublicKey, vs io.Reader, err error) {
  	s, err := newVerifyStream(versionValidator, r, MessageTypeAttachedSignature)
  	if err != nil {
  		return nil, nil, err
  	}
  	skey = keyring.LookupSigningPublicKey(s.header.SenderPublic)
  	if skey == nil {
  		return nil, nil, ErrNoSenderKey
  	}
  	s.publicKey = skey
  	return skey, newChunkReader(s), nil
  }
docs: // NewVerifyStream creates a stream that consumes data from reader
  // r.  It returns the signer's public key and a reader that only
  // contains verified data.  If the signer's key is not in keyring,
  // it will return an error.