code: func (wfe *WebFrontEndImpl) validSelfAuthenticatedJWS(
  	jws *jose.JSONWebSignature,
  	request *http.Request,
  	logEvent *web.RequestEvent) ([]byte, *jose.JSONWebKey, *probs.ProblemDetails) {
  	// Extract the embedded JWK from the parsed JWS
  	pubKey, prob := wfe.extractJWK(jws)
  	if prob != nil {
  		return nil, nil, prob
  	}
  
  	// If the key doesn't meet the GoodKey policy return a problem immediately
  	if err := wfe.keyPolicy.GoodKey(pubKey.Key); err != nil {
  		wfe.stats.joseErrorCount.With(prometheus.Labels{"type": "JWKRejectedByGoodKey"}).Inc()
  		return nil, nil, probs.BadPublicKey(err.Error())
  	}
  
  	// Verify the JWS with the embedded JWK
  	payload, prob := wfe.validJWSForKey(jws, pubKey, request, logEvent)
  	if prob != nil {
  		return nil, nil, prob
  	}
  
  	return payload, pubKey, nil
  }
docs: // validSelfAuthenticatedJWS checks that a given JWS verifies with the JWK
  // embedded in the JWS itself (e.g. self-authenticated). This type of JWS
  // is only used for creating new accounts or revoking a certificate by signing
  // the request with the private key corresponding to the certificate's public
  // key and embedding that public key in the JWS. All other request should be
  // validated using `validJWSforAccount`. If the JWS validates (e.g. the JWS is
  // well formed, verifies with the JWK embedded in it, the JWK meets
  // policy/algorithm requirements, has the correct URL and includes a valid
  // nonce) then `validSelfAuthenticatedJWS` returns the validated JWS body and
  // the JWK that was embedded in the JWS. Otherwise if the valid JWS conditions
  // are not met or an error occurs only a problem is returned