code: func Check(ex pkix.Extension, d *certdata.Data) *errors.Errors {
  	var e = errors.New(nil)
  
  	// If the cert type isn't one of the `allowedCertTypes`, return an error
  	if _, allowed := allowedCertTypes[d.Type]; !allowed {
  		e.Err(certTypeErr)
  	}
  
  	// Per RFC 7633 "The TLS feature extension SHOULD NOT be marked critical"
  	if ex.Critical {
  		e.Err(critExtErr)
  	}
  
  	// Check that the extension value is the expected slice of DER encoded ASN.1
  	if bytes.Compare(ex.Value, expectedExtensionValue) != 0 {
  		e.Err(extValueErr)
  	}
  
  	return e
  }
docs: // Check performs a strict verification on the extension according to the standard(s)