code: func checkSubtoken(c context.Context, subtoken *messages.Subtoken, params *CheckTokenParams) (identity.Identity, error) {
  	if subtoken.Kind != messages.Subtoken_BEARER_DELEGATION_TOKEN {
  		logging.Warningf(c, "auth: Invalid delegation token kind - %s", subtoken.Kind)
  		return "", ErrForbiddenDelegationToken
  	}
  
  	// Do fast checks before heavy ones.
  	now := clock.Now(c).Unix()
  	if err := checkSubtokenExpiration(subtoken, now); err != nil {
  		logging.Warningf(c, "auth: Bad delegation token expiration - %s", err)
  		return "", ErrForbiddenDelegationToken
  	}
  	if err := checkSubtokenServices(subtoken, params.OwnServiceIdentity); err != nil {
  		logging.Warningf(c, "auth: Forbidden delegation token - %s", err)
  		return "", ErrForbiddenDelegationToken
  	}
  
  	// Do the audience check (may use group lookups).
  	if err := checkSubtokenAudience(c, subtoken, params.PeerID, params.GroupsChecker); err != nil {
  		if transient.Tag.In(err) {
  			logging.Warningf(c, "auth: Transient error when checking delegation token audience - %s", err)
  			return "", err
  		}
  		logging.Warningf(c, "auth: Bad delegation token audience - %s", err)
  		return "", ErrForbiddenDelegationToken
  	}
  
  	// Grab delegated identity.
  	ident, err := identity.MakeIdentity(subtoken.DelegatedIdentity)
  	if err != nil {
  		logging.Warningf(c, "auth: Invalid delegated_identity in the delegation token - %s", err)
  		return "", ErrMalformedDelegationToken
  	}
  
  	return ident, nil
  }
docs: // checkSubtoken validates the delegation subtoken.
  //
  // It extracts and returns original delegated_identity.