code: func (t *Token) VerifySigningKey(verifyOpts VerifyOptions) (signingKey libtrust.PublicKey, err error) {
  	// First attempt to get an x509 certificate chain from the header.
  	var (
  		x5c    = t.Header.X5c
  		rawJWK = t.Header.RawJWK
  		keyID  = t.Header.KeyID
  	)
  
  	switch {
  	case len(x5c) > 0:
  		signingKey, err = parseAndVerifyCertChain(x5c, verifyOpts.Roots)
  	case rawJWK != nil:
  		signingKey, err = parseAndVerifyRawJWK(rawJWK, verifyOpts)
  	case len(keyID) > 0:
  		signingKey = verifyOpts.TrustedKeys[keyID]
  		if signingKey == nil {
  			err = fmt.Errorf("token signed by untrusted key with ID: %q", keyID)
  		}
  	default:
  		err = errors.New("unable to get token signing key")
  	}
  
  	return
  }
docs: // VerifySigningKey attempts to get the key which was used to sign this token.
  // The token header should contain either of these 3 fields:
  //      `x5c` - The x509 certificate chain for the signing key. Needs to be
  //              verified.
  //      `jwk` - The JSON Web Key representation of the signing key.
  //              May contain its own `x5c` field which needs to be verified.
  //      `kid` - The unique identifier for the key. This library interprets it
  //              as a libtrust fingerprint. The key itself can be looked up in
  //              the trustedKeys field of the given verify options.
  // Each of these methods are tried in that order of preference until the
  // signing key is found or an error is returned.