code: func (wfe *WebFrontEndImpl) revokeCertByJWK(
  	ctx context.Context,
  	outerJWS *jose.JSONWebSignature,
  	request *http.Request,
  	logEvent *web.RequestEvent) *probs.ProblemDetails {
  	// We maintain the requestKey as a var that is closed-over by the
  	// `authorizedToRevoke` function to use
  	var requestKey *jose.JSONWebKey
  	// For embedded JWK revocations we authenticate the outer JWS by using
  	// `validSelfAuthenticatedJWS` similar to new-reg and key rollover.
  	// We do *not* use `validSelfAuthenticatedPOST` here because we've already
  	// read the HTTP request body in `parseJWSRequest` and it is now empty.
  	jwsBody, jwk, prob := wfe.validSelfAuthenticatedJWS(outerJWS, request, logEvent)
  	if prob != nil {
  		return prob
  	}
  	requestKey = jwk
  	// For embedded JWK revocations we decide if a requester is able to revoke a specific
  	// certificate by checking that to-be-revoked certificate has the same public
  	// key as the JWK that was used to authenticate the request
  	authorizedToRevoke := func(parsedCertificate *x509.Certificate) *probs.ProblemDetails {
  		if !core.KeyDigestEquals(requestKey, parsedCertificate.PublicKey) {
  			return probs.Unauthorized(
  				"JWK embedded in revocation request must be the same public key as the cert to be revoked")
  		}
  		return nil
  	}
  	// We use `0` as the account ID provided to `processRevocation` because this
  	// is a self-authenticated request.
  	return wfe.processRevocation(ctx, jwsBody, 0, authorizedToRevoke, request, logEvent)
  }
docs: // revokeCertByJWK processes an outer JWS as a revocation request that is
  // authenticated by an embedded JWK. E.g. in the case where someone is
  // requesting a revocation by using the keypair associated with the certificate
  // to be revoked