code: func (r *claimResolver) resolve(endpoint endpoint, allClaims claims) error {
  	// TODO: cache resolved claims.
  	jwt, err := getClaimJWT(r.client, endpoint.URL, endpoint.AccessToken)
  	if err != nil {
  		return fmt.Errorf("while getting distributed claim %q: %v", r.claim, err)
  	}
  	untrustedIss, err := untrustedIssuer(jwt)
  	if err != nil {
  		return fmt.Errorf("getting untrusted issuer from endpoint %v failed for claim %q: %v", endpoint.URL, r.claim, err)
  	}
  	v, err := r.Verifier(untrustedIss)
  	if err != nil {
  		return fmt.Errorf("verifying untrusted issuer %v failed: %v", untrustedIss, err)
  	}
  	t, err := v.Verify(context.Background(), jwt)
  	if err != nil {
  		return fmt.Errorf("verify distributed claim token: %v", err)
  	}
  	var distClaims claims
  	if err := t.Claims(&distClaims); err != nil {
  		return fmt.Errorf("could not parse distributed claims for claim %v: %v", r.claim, err)
  	}
  	value, ok := distClaims[r.claim]
  	if !ok {
  		return fmt.Errorf("jwt returned by distributed claim endpoint %s did not contain claim: %v", endpoint, r.claim)
  	}
  	allClaims[r.claim] = value
  	return nil
  }
docs: // resolve requests distributed claims from all endpoints passed in,
  // and inserts the lookup results into allClaims.