Module jwk 

Verification keys from published JWKs (RFC 7517).

Every party that checks a PIC artifact starts from a key someone published: a relying party reading a realm’s jwks_uri, a workload verifying the checkpoint it was handed, a settlement authority reading cnf.jwk out of a Proof of Relationship. Without this they each write the same JWK reader, and each one is a place to get the algorithm agreement wrong.

Algorithm agreement

A key can produce exactly one signature algorithm, and expected_algorithms_for_jwk says which. That is what stops an artifact from choosing how it is verified: a candidate claiming alg that its key cannot produce, or a JWK whose declared alg disagrees with its own key material, is rejected before a signature is checked rather than after.

What is not here

RSA. It is the shape identity providers publish, and an OAuth access token is not a PIC artifact — a deployment that exchanges one reads it with its own code, and this crate stays about the artifacts the profile defines.

The curve implementations follow the crate’s feature flags, so a build that enables none still compiles and every reader here answers “unsupported”.

Structs

ExpectedAlgorithms

The algorithms one key can produce.

JwkVerifier

A verifier over one published key.

Enums

JwkError

Why a JWK could not become a verification key.

Functions

expected_algorithms_for_jwk

The algorithms this JWK’s key material can produce, whatever it claims.

public_key_from_jwk

Builds a verifier from a published JWK.