KemalIdentity::JWT::KeySource

Fetches a provider's signing keys from a JWKS endpoint.

The two failure modes this exists to avoid

Fetching on every request. A JWKS is a network call. Doing one per token turns the identity provider into a hard dependency of every request and hands anybody who can send tokens a way to make you call it — so keys are cached, and the cache is what makes JWT verification local at all.

Never fetching again. A cache with no expiry is a key set that cannot rotate, and the provider will rotate whether or not you noticed. So the cache has a TTL, and an unknown kid triggers one refetch — bounded by #minimum_refresh_interval, because otherwise a stream of tokens carrying invented kids is a way to make you hammer the provider.

Both bounds are the point. A cache without them is either a denial-of-service amplifier or a key set frozen at boot.