code: func unsealToken(c context.Context, tok *messages.DelegationToken, certsProvider CertificatesProvider) (*messages.Subtoken, error) {
  	// Grab the public keys of the service that signed the token, if we trust it.
  	signerID, err := identity.MakeIdentity(tok.SignerId)
  	if err != nil {
  		return nil, fmt.Errorf("bad signer_id %q - %s", tok.SignerId, err)
  	}
  	certs, err := certsProvider.GetCertificates(c, signerID)
  	switch {
  	case err != nil:
  		return nil, fmt.Errorf("failed to grab certificates of %q - %s", tok.SignerId, err)
  	case certs == nil:
  		return nil, fmt.Errorf("the signer %q is not trusted", tok.SignerId)
  	}
  
  	// Check the signature on the token.
  	err = certs.CheckSignature(tok.SigningKeyId, tok.SerializedSubtoken, tok.Pkcs1Sha256Sig)
  	if err != nil {
  		return nil, err
  	}
  
  	// The signature is correct! Deserialize the subtoken.
  	msg := &messages.Subtoken{}
  	if err = proto.Unmarshal(tok.SerializedSubtoken, msg); err != nil {
  		return nil, err
  	}
  
  	return msg, nil
  }
docs: // unsealToken verifies token's signature and deserializes the subtoken.
  //
  // May return transient errors.