Function verify_grant 

pub fn verify_grant(
    signed: &SignedEnvelope,
    grant_pubkey: &[u8; 32],
    local: &MeshId,
) -> Result<CheckoutGrant, LicenceError>

Verify signed under the bound grant_pubkey and require it is for local. The key comparison is the cheap first check.