code: function doVerifyStep() {
      function verified(err, client, info) {
        if (err) { return self.error(err); }
        if (!client) { return self.fail(); }
        self.success(client, info);
      }
      
      // At this point, the assertion has been verified and authentication can
      // proceed.  Call the verify callback so the application can find and verify
      // the client instance.  Typically, the subject and issuer of the assertion
      // are the same, as the client is authenticating as itself.
      try {
        if (self._passReqToCallback) {
          var arity = self._key.length;
          if (arity == 4) {
            // This variation allows the application to detect the case in which
            // the issuer and subject of the assertion are different, and permit
            // or deny as necessary.
            self._verify(req, payload.iss || header.iss, header, verified);
          } else { // arity == 3
            self._verify(req, payload.iss || header.iss, keyed);
          }
        } else {
          var arity = self._key.length;
          if (arity == 3) {
            // This variation allows the application to detect the case in which
            // the issuer and subject of the assertion are different, and permit
            // or deny as necessary.
            self._verify(payload.sub || payload.iss, payload.iss, verified);
          } else { // arity == 2
            self._verify(payload.sub || payload.iss, verified);
          }
        }
      } catch (ex) {
        return self.error(ex);
      }
    }
docs: TODO: Check that we are the intended audience