code: func (wfe *WebFrontEndImpl) validNonce(jws *jose.JSONWebSignature) *probs.ProblemDetails {
  	// validNonce is called after validPOSTRequest() and parseJWS() which
  	// defend against the incorrect number of signatures.
  	header := jws.Signatures[0].Header
  	nonce := header.Nonce
  	if len(nonce) == 0 {
  		wfe.stats.joseErrorCount.With(prometheus.Labels{"type": "JWSMissingNonce"}).Inc()
  		return probs.BadNonce("JWS has no anti-replay nonce")
  	} else if !wfe.nonceService.Valid(nonce) {
  		wfe.stats.joseErrorCount.With(prometheus.Labels{"type": "JWSInvalidNonce"}).Inc()
  		return probs.BadNonce("JWS has an invalid anti-replay nonce: %q", nonce)
  	}
  	return nil
  }
docs: // validNonce checks a JWS' Nonce header to ensure it is one that the
  // nonceService knows about, otherwise a bad nonce problem is returned.
  // NOTE: this function assumes the JWS has already been verified with the
  // correct public key.