code: func checkSubtokenExpiration(t *messages.Subtoken, now int64) error {
  	if t.CreationTime <= 0 {
  		return fmt.Errorf("invalid 'creation_time' field: %d", t.CreationTime)
  	}
  	dur := int64(t.ValidityDuration)
  	if dur <= 0 {
  		return fmt.Errorf("invalid validity_duration: %d", dur)
  	}
  	if t.CreationTime >= now+allowedClockDriftSec {
  		return fmt.Errorf("token is not active yet (created at %d)", t.CreationTime)
  	}
  	if t.CreationTime+dur < now {
  		return fmt.Errorf("token has expired %d sec ago", now-(t.CreationTime+dur))
  	}
  	return nil
  }
docs: // checkSubtokenExpiration checks 'CreationTime' and 'ValidityDuration' fields.