code: func Verify(c context.Context, jwt string) (*Payload, error) {
  	// Grab root Google OAuth2 keys to verify JWT signature. They are most likely
  	// already cached in the process memory.
  	certs, err := signing.FetchGoogleOAuth2Certificates(c)
  	if err != nil {
  		return nil, err
  	}
  	return verifyImpl(c, jwt, certs)
  }
docs: // Verify parses a GCE VM metadata token, verifies its signature and expiration
  // time, and extracts interesting parts of it into Payload struct.
  //
  // Does NOT verify the audience field. This is responsibility of the caller.
  //
  // The token is in JWT form (three dot-separated base64-encoded strings). It is
  // expected to be signed by Google OAuth2 backends using RS256 algo.