code: func CheckSPKI(pin string, cert *x509.Certificate) error {
  	// Check that the format of the pin is valid.
  	parts := strings.Split(pin, ":")
  	if len(parts) != 2 {
  		return trace.BadParameter("invalid format for certificate pin, expected algorithm:pin")
  	}
  	if parts[0] != "sha256" {
  		return trace.BadParameter("sha256 only supported hashing algorithm for certificate pin")
  	}
  
  	// Check that that pin itself matches that value calculated from the passed
  	// in certificate.
  	if subtle.ConstantTimeCompare([]byte(CalculateSPKI(cert)), []byte(pin)) != 1 {
  		return trace.BadParameter(errorMessage)
  	}
  
  	return nil
  }
docs: // CheckSPKI the passed in pin against the calculated value from a certificate.