code: def _verify_signed_jwt_with_certs(
      jwt, time_now, cache,
      cert_uri=_DEFAULT_CERT_URI):
    segments = jwt.split('.')
    if len(segments) != 3:
      raise _AppIdentityError('Token is not an id_token (Wrong number of '
                              'segments)')
    signed = '%s.%s' % (segments[0], segments[1])
    signature = _urlsafe_b64decode(segments[2])
    lsignature = long(signature.encode('hex'), 16)
    header_body = _urlsafe_b64decode(segments[0])
    try:
      header = json.loads(header_body)
    except:
      raise _AppIdentityError("Can't parse header")
    if header.get('alg') != 'RS256':
      raise _AppIdentityError('Unexpected encryption algorithm: %r' %
                              header.get('alg'))
    certs = _get_cached_certs(cert_uri, cache)
    if certs is None:
      raise _AppIdentityError(
          'Unable to retrieve certs needed to verify the signed JWT')
    if not _CRYPTO_LOADED:
      raise _AppIdentityError('Unable to load pycrypto library.  Can\'t verify '
                              'id_token signature.  See http://www.pycrypto.org '
                              'for more information on pycrypto.')
    local_hash = SHA256.new(signed).hexdigest()
    verified = False
    for keyvalue in certs['keyvalues']:
      try:
        modulus = _b64_to_long(keyvalue['modulus'])
        exponent = _b64_to_long(keyvalue['exponent'])
        key = RSA.construct((modulus, exponent))
        hexsig = '%064x' % key.encrypt(lsignature, '')[0]
        hexsig = hexsig[-64:]
        verified = hmac.compare_digest(hexsig, local_hash)
        if verified:
          break
      except Exception, e:
        _logger.debug(
            'Signature verification error: %s; continuing with the next cert.', e)
        continue
    if not verified:
      raise _AppIdentityError('Invalid token signature')
    json_body = _urlsafe_b64decode(segments[1])
    try:
      parsed = json.loads(json_body)
    except:
      raise _AppIdentityError("Can't parse token body")
    iat = parsed.get('iat')
    if iat is None:
      raise _AppIdentityError('No iat field in token')
    earliest = iat - _CLOCK_SKEW_SECS
    exp = parsed.get('exp')
    if exp is None:
      raise _AppIdentityError('No exp field in token')
    if exp >= time_now + _MAX_TOKEN_LIFETIME_SECS:
      raise _AppIdentityError('exp field too far in future')
    latest = exp + _CLOCK_SKEW_SECS
    if time_now < earliest:
      raise _AppIdentityError('Token used too early, %d < %d' %
                              (time_now, earliest))
    if time_now > latest:
      raise _AppIdentityError('Token used too late, %d > %d' %
                              (time_now, latest))
    return parsed