Support Account Defense: Balancing JWKS Caching Against Live Session Introspection

Short answer: verify JWT signatures locally with a cached JWKS, but require live session...