code: func InspectToken(c context.Context, certs tokensigning.CertificatesSupplier, tok string) (*tokensigning.Inspection, error) {
  	i := tokensigning.Inspector{
  		Certificates:   certs,
  		SigningContext: tokenSigningContext,
  		Envelope:       func() proto.Message { return &messages.DelegationToken{} },
  		Body:           func() proto.Message { return &messages.Subtoken{} },
  		Unwrap: func(e proto.Message) tokensigning.Unwrapped {
  			env := e.(*messages.DelegationToken)
  			return tokensigning.Unwrapped{
  				Body:         env.SerializedSubtoken,
  				RsaSHA256Sig: env.Pkcs1Sha256Sig,
  				KeyID:        env.SigningKeyId,
  			}
  		},
  		Lifespan: func(b proto.Message) tokensigning.Lifespan {
  			body := b.(*messages.Subtoken)
  			return tokensigning.Lifespan{
  				NotBefore: time.Unix(body.CreationTime, 0),
  				NotAfter:  time.Unix(body.CreationTime+int64(body.ValidityDuration), 0),
  			}
  		},
  	}
  	return i.InspectToken(c, tok)
  }
docs: // InspectToken returns information about the delegation token.
  //
  // Inspection.Envelope is either nil or *messages.DelegationToken.
  // Inspection.Body is either nil or *messages.Subtoken.