ID Token verification: cached public keys

[samu]

The docs state here that the library "verifies that the given ID token is valid using the cached public keys.".

My interpretation of this is, that the token signature validity is checked using a given public key. When i look at the implementation i can't see any code related to signature verification. Am i missing something, or is it correct that this library is not doing signature verification?