Google domain-wide delegation + curl

Google makes it pretty easy to use a service account with domain-wide delegation through their SDKs (spoiler alert, you just download the service account credentials file from Google, point the SDK at it, and then call a setSubject('whoever@example.com') method). But how do you do this without their SDKs (which are usually thoroughly undocumented) getting in the way? The answer turned out to…