def unseal(token_and_signature, context = nil)
      token = RecoveryToken.parse(token_and_signature)

      unless token.version.to_i == PROTOCOL_VERSION
        raise TokenFormatError, "Version field must be #{PROTOCOL_VERSION}"
      end

      token_data, signature = partition_signed_token(token_and_signature, token)
      self.unseal_keys(context).each do |key|
        return token if self.encryptor.verify(token_data, signature, key, self, context)
      end
      raise CryptoError, "Recovery token signature was invalid"
    end
def unseal(token_and_signature, context = nil)
      token = RecoveryToken.parse(token_and_signature)

      unless token.version.to_i == PROTOCOL_VERSION
        raise TokenFormatError, "Version field must be #{PROTOCOL_VERSION}"
      end

      token_data, signature = partition_signed_token(token_and_signature, token)
      self.unseal_keys(context).each do |key|
        return token if self.encryptor.verify(token_data, signature, key, self, context)
      end
      raise CryptoError, "Recovery token signature was invalid"
    end
Splits the payload by the token size, treats the remaining portion as
 the signature of the payload, and verifies the signature is valid for
 the given payload.

 token_and_signature: binary string consisting of [token_binary_str, signature].join
 keys - An array of public keys to use for signature verification.

 returns a RecoveryToken if the payload has been verified and
 deserializes correctly. Raises exceptions if any crypto fails.
 Raises an error if the token's version field is not valid.