Function open 

pub fn open(
    key: &MintKey,
    tag: &str,
    domain: &[u8],
    token: &str,
    bound_to: &[&str],
) -> Result<Vec<u8>, MacTokenError>

Verifies one token of the family named by tag and domain and returns its payload bytes.

The MAC comparison is verify_slice, which is constant-time; comparing decoded bytes with == would leak the signature one byte at a time.