def verify_signed_jwt_with_certs(jwt, certs, audience=None):
jwt = _helpers._to_bytes(jwt)<EOL>if jwt.count(b'<STR_LIT:.>') != <NUM_LIT:2>:<EOL><INDENT>raise AppIdentityError(<EOL>'<STR_LIT>'.format(jwt))<EOL><DEDENT>header, payload, signature = jwt.split(b'<STR_LIT:.>')<EOL>message_to_sign = header + b'<STR_LIT:.>' + payload<EOL>signature = _helpers._urlsafe_b64decode(signature)<EOL>payload_bytes = _helpers._urlsafe_b64decode(payload)<EOL>try:<EOL><INDENT>payload_dict = json.loads(_helpers._from_bytes(payload_bytes))<EOL><DEDENT>except:<EOL><INDENT>raise AppIdentityError('<STR_LIT>'.format(payload_bytes))<EOL><DEDENT>_verify_signature(message_to_sign, signature, certs.values())<EOL>_verify_time_range(payload_dict)<EOL>_check_audience(payload_dict, audience)<EOL>return payload_dict<EOL>
Verify a JWT against public certs.

    See http://self-issued.info/docs/draft-jones-json-web-token.html.

    Args:
        jwt: string, A JWT.
        certs: dict, Dictionary where values of public keys in PEM format.
        audience: string, The audience, 'aud', that this JWT should contain. If
                  None then the JWT's 'aud' parameter is not verified.

    Returns:
        dict, The deserialized JSON payload in the JWT.

    Raises:
        AppIdentityError: if any checks are failed.