Struct MultiKeyVerifier 

pub struct MultiKeyVerifier { /* private fields */ }

A JwsVerifier that holds multiple keys and applies RFC 7517 key selection semantics.

Key selection follows KeyMatchStrength priority:

• A ByKeyId match (algorithm + kid) is definitive — that key is used exclusively.
• Multiple ByAlgorithm matches are ambiguous; returns AmbiguousKeyMatch unless try_all_on_ambiguous_match is set, in which case each candidate is tried in order.
• A single ByAlgorithm match is used directly.

For a JWKS-backed verifier with automatic refresh and retry wrapped around this type, use JwksSource; construct MultiKeyVerifier directly only for a custom stack.

Implementations

impl MultiKeyVerifier

pub fn new(verifiers: Vec<Arc<dyn JwsVerifier>>) -> Self

Creates a MultiKeyVerifier from an explicit list of verifiers.

pub async fn from_jwks( jwks: &PublicJwks, platform: &dyn JwsVerifierPlatform, ) -> Result<Self, Error>

Builds a MultiKeyVerifier from a JWKS document.

Keys with unsupported algorithms are silently skipped.

This is a general-purpose constructor with no key-count limit: it may be fed from a trusted source (a KMS, an enclave, a local file) as well as a remote JWKS. Bounding the key count of an untrusted, remotely-fetched document is the fetcher’s job — see JwksSource.

Errors

Returns ErrorKind::Crypto if a supported key fails to construct a verifier.

pub fn try_all_on_ambiguous_match(self, value: bool) -> Self

Configures whether to try all matching keys when no kid is present and multiple keys match by algorithm.

When false (the default), multiple algorithm matches without a kid return AmbiguousKeyMatch. When true, each candidate is tried in order and the first success is accepted.

Trait Implementations

impl Debug for MultiKeyVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl JwsVerifier for MultiKeyVerifier

fn key_match(&self, key_match: &KeyMatch<'_>) -> Option<KeyMatchStrength>

Returns how well this verifier matches the given key selection criteria.

fn verify<'a>( &'a self, input: &'a [u8], signature: &'a [u8], key_match: &'a KeyMatch<'a>, ) -> MaybeSendBoxFuture<'a, Result<(), VerifyError>>

Verify the input against the provided signature.

fn try_refresh(&self) -> MaybeSendBoxFuture<'_, bool>

Requests a best-effort refresh of the verifier’s key material.