code: func (db *SnapshotDB) fetchTrustedCerts(c context.Context) (certMap, error) {
  	if db.tokenServiceURL == "" {
  		logging.Warningf(
  			c, "Delegation is not supported, the token server URL is not set by %s",
  			db.AuthServiceURL)
  		return certMap{}, nil
  	}
  
  	certs, err := signing.FetchCertificatesFromLUCIService(c, db.tokenServiceURL)
  	if err != nil {
  		return nil, err
  	}
  	if certs.ServiceAccountName == "" {
  		return nil, fmt.Errorf("the token server %s didn't provide its service account name", db.tokenServiceURL)
  	}
  
  	id, err := identity.MakeIdentity("user:" + certs.ServiceAccountName)
  	if err != nil {
  		return nil, fmt.Errorf("invalid service_account_name %q in fetched certificates bundle - %s", certs.ServiceAccountName, err)
  	}
  
  	return certMap{id: certs}, nil
  }
docs: //// Implementation details.
  // fetchTrustedCerts is called by GetCertificates to fetch certificates.
  //
  // We currently trust only the token server, as provided by the auth service.