if ( tag != expectTag ) {
            throw new IOException("Unexpected tag " + tag);
        }
        int length = readLength(in, limit, false);
        byte[] content = new byte[length];
        in.read(content);
        return content;
    }

    // shamelessly stolen from BC ASN1InputStream
    static int readTagNumber(InputStream s, int tag)
            throws IOException
    {

        byte[] content;
        try ( ASN1InputStream stream = new ASN1InputStream(token) ) {
            content = ASN1Util.readUnparsedTagged(0, 0x8000, stream);
        }catch ( IOException e ) {
            throw new PACDecodingException("Malformed kerberos token", e);
        }

        try ( ASN1InputStream stream = new ASN1InputStream(content) ) {