Function seal 

pub fn seal(
    key: &MintKey,
    tag: &str,
    domain: &[u8],
    payload_json: &[u8],
    bound_to: &[&str],
) -> String

Mints one token over payload_json, for the family named by tag and domain.

Each value in bound_to is covered by the MAC and left out of the token, so redemption requires asserting it.