JWKS and time-of-use verification
