code: func (wfe *WebFrontEndImpl) extractJWK(jws *jose.JSONWebSignature) (*jose.JSONWebKey, *probs.ProblemDetails) {
  	// extractJWK expects the request to be using an embedded JWK auth type and
  	// to not contain the mutually exclusive KeyID.
  	if prob := wfe.enforceJWSAuthType(jws, embeddedJWK); prob != nil {
  		return nil, prob
  	}
  
  	// extractJWK must be called after parseJWS() which defends against the
  	// incorrect number of signatures.
  	header := jws.Signatures[0].Header
  	// We can be sure that JSONWebKey is != nil because we have already called
  	// enforceJWSAuthType()
  	key := header.JSONWebKey
  
  	// If the key isn't considered valid by go-jose return a problem immediately
  	if !key.Valid() {
  		wfe.stats.joseErrorCount.With(prometheus.Labels{"type": "JWKInvalid"}).Inc()
  		return nil, probs.Malformed("Invalid JWK in JWS header")
  	}
  
  	return key, nil
  }
docs: // extractJWK extracts a JWK from a provided JWS or returns a problem. It
  // expects that the JWS is using the embedded JWK style of authentication and
  // does not contain an embedded Key ID. Callers should have acquired the
  // provided JWS from parseJWS to ensure it has the correct number of signatures
  // present.