code: func (s *AuthService) decodeMessage(m *pubSubMessage, certs *signing.PublicCertificates) (*protocol.ChangeNotification, error) {
  	// Key name used to sign.
  	keyName := m.Message.Attributes["X-AuthDB-SigKey-v1"]
  	if keyName == "" {
  		return nil, fmt.Errorf("X-AuthDB-SigKey-v1 attribute is not set")
  	}
  
  	// The signature.
  	sigBase64 := m.Message.Attributes["X-AuthDB-SigVal-v1"]
  	if sigBase64 == "" {
  		return nil, fmt.Errorf("X-AuthDB-SigVal-v1 attribute is not set")
  	}
  	sig, err := base64.StdEncoding.DecodeString(sigBase64)
  	if err != nil {
  		return nil, fmt.Errorf("the message signature is not valid base64 - %s", err)
  	}
  
  	// Message body.
  	body, err := base64.StdEncoding.DecodeString(m.Message.Data)
  	if err != nil {
  		return nil, fmt.Errorf("the message body is not valid base64 - %s", err)
  	}
  
  	// Validate.
  	if err := certs.CheckSignature(keyName, body, sig); err != nil {
  		return nil, err
  	}
  
  	// Deserialize.
  	out := protocol.ChangeNotification{}
  	if err := proto.Unmarshal(body, &out); err != nil {
  		return nil, err
  	}
  	return &out, nil
  }
docs: ///
  // decodeMessage checks that the message payload was signed by Auth service key
  // and deserializes it.