code: func Mint(c context.Context, params *MintParams) (*tokenserver.MachineTokenBody, string, error) {
  	if err := params.Validate(); err != nil {
  		return nil, "", err
  	}
  	fqdn, err := params.MachineFQDN()
  	if err != nil {
  		panic("impossible") // checked in Validate already
  	}
  	chunks := strings.SplitN(fqdn, ".", 2)
  	if len(chunks) != 2 {
  		panic("impossible") // checked in Validate already
  	}
  	cfg := domainConfig(params.Config, chunks[1])
  	if cfg == nil {
  		panic("impossible") // checked in Validate already
  	}
  
  	srvInfo, err := params.Signer.ServiceInfo(c)
  	if err != nil {
  		return nil, "", transient.Tag.Apply(err)
  	}
  
  	body := &tokenserver.MachineTokenBody{
  		MachineFqdn: fqdn,
  		IssuedBy:    srvInfo.ServiceAccountName,
  		IssuedAt:    uint64(clock.Now(c).Unix()),
  		Lifetime:    uint64(cfg.MachineTokenLifetime),
  		CaId:        params.Config.UniqueId,
  		CertSn:      params.Cert.SerialNumber.Uint64(), // already validated, fits uint64
  	}
  	signed, err := SignToken(c, params.Signer, body)
  	if err != nil {
  		return nil, "", err
  	}
  	return body, signed, nil
  }
docs: // Mint generates a new machine token proto, signs and serializes it.
  //
  // Returns its body as a proto, and as a signed base64-encoded final token.