func (c *ClaimsData) Verify(payload string, sig []byte) bool {
	kp, err := nkeys.FromPublicKey(c.Issuer)
	if err != nil {
		return false
	}
	if err := kp.Verify([]byte(payload), sig); err != nil {
		return false
	}
	return true
}
Verify verifies that the encoded payload was signed by the
provided public key. Verify is called automatically with
the claims portion of the token and the public key in the claim.
Client code need to insure that the public key in the
claim is trusted.
package jwt
import (
	"crypto/sha512"
	"encoding/base32"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"strings"
	"time"
	"github.com/nats-io/nkeys"
)
type ClaimType string
const (
	AccountClaim = "account"
	ActivationClaim = "activation"
	UserClaim = "user"
	ServerClaim = "server"
	ClusterClaim = "cluster"
	OperatorClaim = "operator"
)
type Claims interface {
	Claims() *ClaimsData
	Encode(kp nkeys.KeyPair) (string, error)
	ExpectedPrefixes() []nkeys.PrefixByte
	Payload() interface{}
	String() string
	Validate(vr *ValidationResults)
	Verify(payload string, sig []byte) bool
}
type ClaimsData struct {
	Audience  string    `json:"aud,omitempty"`
	Expires   int64     `json:"exp,omitempty"`
	ID        string    `json:"jti,omitempty"`
	IssuedAt  int64     `json:"iat,omitempty"`
	Issuer    string    `json:"iss,omitempty"`
	Name      string    `json:"name,omitempty"`
	NotBefore int64     `json:"nbf,omitempty"`
	Subject   string    `json:"sub,omitempty"`
	Tags      TagList   `json:"tags,omitempty"`
	Type      ClaimType `json:"type,omitempty"`
}
type Prefix struct {
	nkeys.PrefixByte
}
func encodeToString(d []byte) string {
	return base64.RawURLEncoding.EncodeToString(d)
}
func decodeString(s string) ([]byte, error) {
	return base64.RawURLEncoding.DecodeString(s)
}
func serialize(v interface{}) (string, error) {
	j, err := json.Marshal(v)
	if err != nil {
		return "", err
	}
	return encodeToString(j), nil
}
func (c *ClaimsData) doEncode(header *Header, kp nkeys.KeyPair, claim Claims) (string, error) {
	if header == nil {
		return "", errors.New("header is required")
	}
	if kp == nil {
		return "", errors.New("keypair is required")
	}
	if c.Subject == "" {
		return "", errors.New("subject is not set")
	}
	h, err := serialize(header)
	if err != nil {
		return "", err
	}
	issuerBytes, err := kp.PublicKey()
	if err != nil {
		return "", err
	}
	prefixes := claim.ExpectedPrefixes()
	if prefixes != nil {
		ok := false
		for _, p := range prefixes {
			switch p {
			case nkeys.PrefixByteAccount:
				if nkeys.IsValidPublicAccountKey(issuerBytes) {
					ok = true
				}
			case nkeys.PrefixByteOperator:
				if nkeys.IsValidPublicOperatorKey(issuerBytes) {
					ok = true
				}
			case nkeys.PrefixByteServer:
				if nkeys.IsValidPublicServerKey(issuerBytes) {
					ok = true
				}
			case nkeys.PrefixByteCluster:
				if nkeys.IsValidPublicClusterKey(issuerBytes) {
					ok = true
				}
			case nkeys.PrefixByteUser:
				if nkeys.IsValidPublicUserKey(issuerBytes) {
					ok = true
				}
			}
		}
		if !ok {
			return "", fmt.Errorf("unable to validate expected prefixes - %v", prefixes)
		}
	}
	c.Issuer = string(issuerBytes)
	c.IssuedAt = time.Now().UTC().Unix()
	c.ID, err = c.hash()
	if err != nil {
		return "", err
	}
	payload, err := serialize(claim)
	if err != nil {
		return "", err
	}
	sig, err := kp.Sign([]byte(payload))
	if err != nil {
		return "", err
	}
	eSig := encodeToString(sig)
	return fmt.Sprintf("%s.%s.%s", h, payload, eSig), nil
}
func (c *ClaimsData) hash() (string, error) {
	j, err := json.Marshal(c)
	if err != nil {
		return "", err
	}
	h := sha512.New512_256()
	h.Write(j)
	return base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(h.Sum(nil)), nil
}
func (c *ClaimsData) Encode(kp nkeys.KeyPair, payload Claims) (string, error) {
	return c.doEncode(&Header{TokenTypeJwt, AlgorithmNkey}, kp, payload)
}
func (c *ClaimsData) String(claim interface{}) string {
	j, err := json.MarshalIndent(claim, "", "  ")
	if err != nil {
		return ""
	}
	return string(j)
}
func parseClaims(s string, target Claims) error {
	h, err := decodeString(s)
	if err != nil {
		return err
	}
	return json.Unmarshal(h, &target)
}