feat(delegation): make Token constructors resemble invocation.New() signature

token/invocation/schema_test.go

@@ -10,6 +10,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gotest.tools/v3/golden"
 
+	"github.com/ucan-wg/go-ucan/did/didtest"
 	"github.com/ucan-wg/go-ucan/token/internal/envelope"
 	"github.com/ucan-wg/go-ucan/token/invocation"
 )
@@ -78,6 +79,16 @@ func TestSchemaRoundTrip(t *testing.T) {
 
 		assert.JSONEq(t, string(invocationJson), readJson.String())
 	})
+
+	t.Run("fails with wrong PrivKey", func(t *testing.T) {
+		t.Parallel()
+
+		p1, err := invocation.FromDagJson(invocationJson)
+		require.NoError(t, err)
+
+		_, _, err = p1.ToSealed(didtest.PersonaBob.PrivKey())
+		require.EqualError(t, err, "private key doesn't match the issuer")
+	})
 }
 
 func privKey(t require.TestingT, privKeyCfg string) crypto.PrivKey {