JWKS based Auth for Receivers instead of OAuth

Starting a discussion to focus specifically on simplifying the auth story of Receivers calling Transmitter endpoints.

I believe an equivalent story for Receivers, as we have for Transmitters (sending signed events + signature verification using public key), would make interop seamless.

From https://github.com/openid/sharedsignals/issues/298#issuecomment-3378688175

Even just putting a jwks_uri in the Receiver's .well-known configuration will be a great benefit - since it trivializes auth completely.

Today, the recommendation is to use OAuth with scopes like ssf.manage and ssf.read. But that means the Administrator must explicitly grant permissions to access the Transmitter endpoints, and that the Receiver must generate/request appropriate tokens. Which increases friction and interop burden.

Now imagine if Receivers published a jwks_uri:

1. Admin configures the Transmitter jwks_uri (via .well-known) in the Receiver Admin Console.

2. Admin configures the Receiver jwks_uri (via .well-known) in the Transmitter Admin Console.

3. Trust is thus established.

   • Just like how the Receiver verifies the signature of SETs sent by the Transmitter,
   • The Transmitter can verify now that a Stream Management request is coming from an Admin-registered Receiver.

(Note: Signing details need to be hashed out)

No files, tests, or implementation entry points are named. Start by reviewing the linked discussion in issue #298 and the Receiver/Transmitter authentication flow described here; the work is complete only after the JWKS-based approach and signing details are agreed and specified.