code: func CheckToken(c context.Context, params CheckTokenParams) (identity.Identity, error) {
  	// base64-encoded token -> DelegationToken proto (with signed serialized
  	// subtoken).
  	tok, err := deserializeToken(params.Token)
  	if err != nil {
  		logging.Warningf(c, "auth: Failed to deserialize delegation token - %s", err)
  		return "", ErrMalformedDelegationToken
  	}
  
  	// Signed serialized subtoken -> Subtoken proto.
  	subtoken, err := unsealToken(c, tok, params.CertificatesProvider)
  	if err != nil {
  		if transient.Tag.In(err) {
  			logging.Warningf(c, "auth: Transient error when checking delegation token signature - %s", err)
  			return "", err
  		}
  		logging.Warningf(c, "auth: Failed to check delegation token signature - %s", err)
  		return "", ErrUnsignedDelegationToken
  	}
  
  	// Validate all constrains encoded in the token and derive the delegated
  	// identity.
  	return checkSubtoken(c, subtoken, &params)
  }
docs: // CheckToken verifies validity of a delegation token.
  //
  // If the token is valid, it returns the delegated identity (embedded in the
  // token).
  //
  // May return transient errors.