JWT verification

One rate-limited JWKS refresh on an unknown kid replaces a 15-minute failure window

A verifier picks its key from the JWT header before it checks any signature, so a rotated issuer key fails key selection. The Go sample in this walkthrough coalesces the misses into one gated fetch and keeps the old key set when that fetch errors.