code: func rsaVerify(ctx pkcs11helpers.PKCtx, session pkcs11.SessionHandle, object pkcs11.ObjectHandle, pub *rsa.PublicKey) error {
  	nonce, err := getRandomBytes(ctx, session)
  	if err != nil {
  		return fmt.Errorf("Failed to retrieve nonce: %s", err)
  	}
  	log.Printf("\tConstructed nonce: %d (%X)\n", big.NewInt(0).SetBytes(nonce), nonce)
  	digest := sha256.Sum256(nonce)
  	log.Printf("\tMessage SHA-256 hash: %X\n", digest)
  	signature, err := pkcs11helpers.Sign(ctx, session, object, pkcs11helpers.RSAKey, digest[:], crypto.SHA256)
  	if err != nil {
  		return fmt.Errorf("Failed to sign data: %s", err)
  	}
  	log.Printf("\tMessage signature: %X\n", signature)
  	err = rsa.VerifyPKCS1v15(pub, crypto.SHA256, digest[:], signature)
  	if err != nil {
  		return fmt.Errorf("Failed to verify signature: %s", err)
  	}
  	log.Println("\tSignature verified")
  	return nil
  }
docs: // rsaVerify verifies that the extracted public key corresponds with the generated
  // private key on the device, specified by the provided object handle, by signing
  // a nonce generated on the device and verifying the returned signature using the
  // public key.