I think we need a check for expired_at as well, see comment here: https://github.com/themis/themis/pull/2424/files#diff-105065541c3fdaeeab12320ccfc8398eR31