code: func (wfe *WebFrontEndImpl) enforceJWSAuthType(
  	jws *jose.JSONWebSignature,
  	expectedAuthType jwsAuthType) *probs.ProblemDetails {
  	// Check the auth type for the provided JWS
  	authType, prob := checkJWSAuthType(jws)
  	if prob != nil {
  		wfe.stats.joseErrorCount.With(prometheus.Labels{"type": "JWSAuthTypeInvalid"}).Inc()
  		return prob
  	}
  	// If the auth type isn't the one expected return a sensible problem based on
  	// what was expected
  	if authType != expectedAuthType {
  		wfe.stats.joseErrorCount.With(prometheus.Labels{"type": "JWSAuthTypeWrong"}).Inc()
  		switch expectedAuthType {
  		case embeddedKeyID:
  			return probs.Malformed("No Key ID in JWS header")
  		case embeddedJWK:
  			return probs.Malformed("No embedded JWK in JWS header")
  		}
  	}
  	return nil
  }
docs: // enforceJWSAuthType enforces a provided JWS has the provided auth type. If there
  // is an error determining the auth type or if it is not the expected auth type
  // then a problem is returned.