code: func (va *ValidationAuthorityImpl) validate(
  	ctx context.Context,
  	identifier core.AcmeIdentifier,
  	challenge core.Challenge,
  	authz core.Authorization,
  ) ([]core.ValidationRecord, *probs.ProblemDetails) {
  
  	// If the identifier is a wildcard domain we need to validate the base
  	// domain by removing the "*." wildcard prefix. We create a separate
  	// `baseIdentifier` here before starting the `va.checkCAA` goroutine with the
  	// `identifier` to avoid a data race.
  	baseIdentifier := identifier
  	if strings.HasPrefix(identifier.Value, "*.") {
  		baseIdentifier.Value = strings.TrimPrefix(identifier.Value, "*.")
  	}
  
  	// va.checkCAA accepts wildcard identifiers and handles them appropriately so
  	// we can dispatch `checkCAA` with the provided `identifier` instead of
  	// `baseIdentifier`
  	ch := make(chan *probs.ProblemDetails, 1)
  	go func() {
  		params := &caaParams{
  			accountURIID:     &authz.RegistrationID,
  			validationMethod: &challenge.Type,
  		}
  		ch <- va.checkCAA(ctx, identifier, params)
  	}()
  
  	// TODO(#1292): send into another goroutine
  	validationRecords, err := va.validateChallenge(ctx, baseIdentifier, challenge)
  	if err != nil {
  		return validationRecords, err
  	}
  
  	for i := 0; i < cap(ch); i++ {
  		if extraProblem := <-ch; extraProblem != nil {
  			return validationRecords, extraProblem
  		}
  	}
  	return validationRecords, nil
  }
docs: // validate performs a challenge validation and, in parallel,
  // checks CAA and GSB for the identifier. If any of those steps fails, it
  // returns a ProblemDetails plus the validation records created during the
  // validation attempt.