KeySource

A source of candidate verification keys. keysFor(kid) returns the PEM public keys to try for a token bearing the given kid (empty kid means the header had none).