Function check 

pub fn check(payload: &str, sig: &str) -> Result<(String, Signed), SignError>

Checks that sig signs the kept bytes of payload, then decodes them. Gives the thumbprint of the key and the fields. It never encodes the payload again.

use base64::Engine;
use riff_core::dpop::Key;
use riff_core::signed::{check, sign_payload};

let key = Key::generate();
// A payload with a field that this build does not know.
let json = r#"{"from":{"user":"ann","session":"s1"},"lead":false,"thread":"design",
    "to":[],"body":"hi","kind":"message","at_ms":5,"reply_to":7}"#;
let payload = base64::engine::general_purpose::URL_SAFE_NO_PAD.encode(json);
let sig = sign_payload(&payload, &key);
let (jkt, signed) = check(&payload, &sig).unwrap();
assert_eq!(jkt, key.thumbprint());
assert_eq!(signed.body, "hi");