Still missing: - Caching of the already checked JWTs (although it could be done at an upper layer). - Caching of the jwks_uri to avoid 2 roundtrips for each verification.
