public function verifySymmetricAuthenticatedResponse(
        ResponseInterface $response,
        SharedAuthenticationKey $key
    ): ResponseInterface {
        /** @var array<int, string> */
        $headers = $response->getHeader((string) static::HEADER_SIGNATURE_NAME);
        if (!$headers) {
            throw new HeaderMissingException(
                'No signed response header (' . (string) static::HEADER_SIGNATURE_NAME . ') found.'
            );
        }

        $body = (string) $response->getBody();
        foreach ($headers as $head) {
            $result = \ParagonIE_Sodium_Compat::crypto_auth_verify(
                Base64UrlSafe::decode($head),
                $body,
                $key->getString(true)
            );
            if ($result) {
                return $response;
            }
        }
        throw new InvalidMessageException('No valid signature given for this HTTP response');
    }