code: func checkJWSAuthType(jws *jose.JSONWebSignature) (jwsAuthType, *probs.ProblemDetails) {
  	// checkJWSAuthType is called after parseJWS() which defends against the
  	// incorrect number of signatures.
  	header := jws.Signatures[0].Header
  	// There must not be a Key ID *and* an embedded JWK
  	if header.KeyID != "" && header.JSONWebKey != nil {
  		return invalidAuthType, probs.Malformed("jwk and kid header fields are mutually exclusive")
  	} else if header.KeyID != "" {
  		return embeddedKeyID, nil
  	} else if header.JSONWebKey != nil {
  		return embeddedJWK, nil
  	}
  	return invalidAuthType, nil
  }
docs: // checkJWSAuthType examines a JWS' protected headers to determine if
  // the request being authenticated by the JWS is identified using an embedded
  // JWK or an embedded key ID. If no signatures are present, or mutually
  // exclusive authentication types are specified at the same time, a problem is
  // returned. checkJWSAuthType is separate from enforceJWSAuthType so that
  // endpoints that need to handle both embedded JWK and embedded key ID requests
  // can determine which type of request they have and act accordingly (e.g.
  // acme v2 cert revocation).