code: func FetchCertificatesForServiceAccount(c context.Context, email string) (*PublicCertificates, error) {
  	// Do only basic validation and offload full validation to the google backend.
  	if !strings.HasSuffix(email, ".gserviceaccount.com") {
  		return nil, fmt.Errorf("signature: not a google service account %q", email)
  	}
  	certs, err := certsCache.LRU(c).GetOrCreate(c, "email:"+email, func() (interface{}, time.Duration, error) {
  		certs, err := fetchCertsJSON(c, robotCertsURL+url.QueryEscape(email))
  		if err != nil {
  			return nil, 0, err
  		}
  		certs.ServiceAccountName = email
  		return certs, CertsCacheExpiration, nil
  	})
  	if err != nil {
  		return nil, err
  	}
  	return certs.(*PublicCertificates), nil
  }
docs: // FetchCertificatesForServiceAccount fetches certificates of some Google
  // service account.
  //
  // Works only with Google service accounts (@*.gserviceaccount.com). Uses the
  // process cache to cache them for CertsCacheExpiration minutes.
  //
  // Usage (roughly):
  //
  //   certs, err := signing.FetchCertificatesForServiceAccount(ctx, <email>)
  //   if certs.CheckSignature(<key id>, <blob>, <signature>) == nil {
  //     <signature is valid!>
  //   }