Where is `jwksURL` used?

Hello there,

I was wondering where exactly jwksURL is used in the library? We're trying to implement OAuth2 authentication (specifically, an implementation of single sign-on that allows our users to sign on via an IDP; the token exchange is PKCE -- we're implementing this for mobile devices), and upon reading our discovery document, the code seems to be telling us that jwks_uri is a required JSON key-value pair.

However, we're not going to need this key for our authentication process.

Upon looking through the library code (workspace search for - jwksURL, the getter for the value from the _discoveryDictionary), it does not look like jwksURL is used at all - it's read and then stored, then seemingly never accessed.

My question is: why is this a required key when it appears to never be used? Please correct me if I'm in the wrong here.

Start with the jwksURL getter and its _discoveryDictionary entry, then use a workspace search to find every reference and the discovery-document validation path. Compare those uses with the reported PKCE flow; the issue is done when the project explains whether jwks_uri must remain required or records an agreed behavior change.