code: func verify(msg, tok []byte, ttl time.Duration, now time.Time, k *Key) []byte {
  	if len(tok) < 1 || tok[0] != version {
  		return nil
  	}
  	ts := time.Unix(int64(binary.BigEndian.Uint64(tok[1:])), 0)
  	if ttl > 0 && (now.After(ts.Add(ttl)) || ts.After(now.Add(maxClockSkew))) {
  		return nil
  	}
  	n := len(tok) - sha256.Size
  	var hmac [sha256.Size]byte
  	genhmac(hmac[:0], tok[:n], k.signBytes())
  	if subtle.ConstantTimeCompare(tok[n:], hmac[:]) != 1 {
  		return nil
  	}
  	pay := tok[payOffset : len(tok)-sha256.Size]
  	if len(pay)%aes.BlockSize != 0 {
  		return nil
  	}
  	if msg != nil {
  		copy(msg, pay)
  		pay = msg
  	}
  	bc, _ := aes.NewCipher(k.cryptBytes())
  	iv := tok[9:][:aes.BlockSize]
  	cipher.NewCBCDecrypter(bc, iv).CryptBlocks(pay, pay)
  	return unpad(pay)
  }
docs: // if msg is nil, decrypts in place and returns a slice of tok.