code: func (wfe *WebFrontEndImpl) revokeCertByKeyID(
  	ctx context.Context,
  	outerJWS *jose.JSONWebSignature,
  	request *http.Request,
  	logEvent *web.RequestEvent) *probs.ProblemDetails {
  	// For Key ID revocations we authenticate the outer JWS by using
  	// `validJWSForAccount` similar to other WFE endpoints
  	jwsBody, _, acct, prob := wfe.validJWSForAccount(outerJWS, request, ctx, logEvent)
  	if prob != nil {
  		return prob
  	}
  	// For Key ID revocations we decide if an account is able to revoke a specific
  	// certificate by checking that the account has valid authorizations for all
  	// of the names in the certificate or was the issuing account
  	authorizedToRevoke := func(parsedCertificate *x509.Certificate) *probs.ProblemDetails {
  		cert, err := wfe.SA.GetCertificate(ctx, core.SerialToString(parsedCertificate.SerialNumber))
  		if err != nil {
  			return probs.ServerInternal("Failed to retrieve certificate")
  		}
  		if cert.RegistrationID == acct.ID {
  			return nil
  		}
  		valid, err := wfe.acctHoldsAuthorizations(ctx, acct.ID, parsedCertificate.DNSNames)
  		if err != nil {
  			return probs.ServerInternal("Failed to retrieve authorizations for names in certificate")
  		}
  		if !valid {
  			return probs.Unauthorized(
  				"The key ID specified in the revocation request does not hold valid authorizations for all names in the certificate to be revoked")
  		}
  		return nil
  	}
  	return wfe.processRevocation(ctx, jwsBody, acct.ID, authorizedToRevoke, request, logEvent)
  }
docs: // revokeCertByKeyID processes an outer JWS as a revocation request that is
  // authenticated by a KeyID and the associated account.