code: func (m *MachineTokenAuthMethod) checkSignature(c context.Context, signerEmail string, envelope *tokenserver.MachineTokenEnvelope) error {
  	// Note that FetchCertificatesForServiceAccount implements caching inside.
  	fetcher := m.certsFetcher
  	if fetcher == nil {
  		fetcher = signing.FetchCertificatesForServiceAccount
  	}
  	certs, err := fetcher(c, signerEmail)
  	if err != nil {
  		return transient.Tag.Apply(err)
  	}
  	return certs.CheckSignature(envelope.KeyId, envelope.TokenBody, envelope.RsaSha256)
  }
docs: // checkSignature verifies the token signature.