Source:
<code>public static AbstractJwsSigner createJwsSigner(Jwt idToken, OpenIdConfigurationResponse discoveryResponse, PublicOpKeyService keyService, OpClientFactory opClientFactory, Rp rp) { final String algorithm = idToken.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM); final SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.fromString(algorithm); final String jwkUrl = discoveryResponse.getJwksUri(); String kid = idToken.getHeader().getClaimAsString(JwtHeaderName.KEY_ID); if (signatureAlgorithm == null) throw new HttpException(ErrorResponseCode.INVALID_ALGORITHM); if (Strings.isNullOrEmpty(kid) && (signatureAlgorithm.getFamily() == AlgorithmFamily.RSA || signatureAlgorithm.getFamily() == AlgorithmFamily.EC)) { LOG.warn("`kid` is missing in id_token. Checking keystore for `kid`"); kid = keyService.getKeyId(idToken, jwkUrl, signatureAlgorithm, Use.SIGNATURE); if (Strings.isNullOrEmpty(kid)) { throw new HttpException(ErrorResponseCode.KEY_ID_NOT_FOUND); } } if (signatureAlgorithm.getFamily() == AlgorithmFamily.RSA) { <START> final RSAPublicKey publicKey = JwkClient.getRSAPublicKey(jwkUrl, kid); <END> return opClientFactory.createRSASigner(signatureAlgorithm, publicKey); } else if (signatureAlgorithm.getFamily() == AlgorithmFamily.HMAC) { return new HMACSigner(signatureAlgorithm, rp.getClientSecret()); } else if (signatureAlgorithm.getFamily() == AlgorithmFamily.EC) { ECDSAPublicKey publicKey = JwkClient.getECDSAPublicKey(jwkUrl, kid); return new ECDSASigner(signatureAlgorithm, publicKey); } throw new HttpException(ErrorResponseCode.ALGORITHM_NOT_SUPPORTED); }</code><technical_language>keyService here, intention is cache key temporary heavy load download keys time</technical_language>

Target:
public static AbstractJwsSigner createJwsSigner(Jwt idToken, OpenIdConfigurationResponse discoveryResponse, PublicOpKeyService keyService, OpClientFactory opClientFactory, Rp rp) { final String algorithm = idToken.getHeader().getClaimAsString(JwtHeaderName.ALGORITHM); final SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.fromString(algorithm); final String jwkUrl = discoveryResponse.getJwksUri(); String kid = idToken.getHeader().getClaimAsString(JwtHeaderName.KEY_ID); if (signatureAlgorithm == null) throw new HttpException(ErrorResponseCode.INVALID_ALGORITHM); if (Strings.isNullOrEmpty(kid) && (signatureAlgorithm.getFamily() == AlgorithmFamily.RSA || signatureAlgorithm.getFamily() == AlgorithmFamily.EC)) { LOG.warn("`kid` is missing in id_token. Checking keystore for `kid`"); kid = keyService.getKeyId(idToken, jwkUrl, signatureAlgorithm, Use.SIGNATURE); if (Strings.isNullOrEmpty(kid)) { throw new HttpException(ErrorResponseCode.KEY_ID_NOT_FOUND); } } if (signatureAlgorithm.getFamily() == AlgorithmFamily.RSA) { final RSAPublicKey publicKey = (RSAPublicKey) keyService.getPublicKey(jwkUrl, kid); return opClientFactory.createRSASigner(signatureAlgorithm, publicKey); } else if (signatureAlgorithm.getFamily() == AlgorithmFamily.HMAC) { return new HMACSigner(signatureAlgorithm, rp.getClientSecret()); } else if (signatureAlgorithm.getFamily() == AlgorithmFamily.EC) { final ECDSAPublicKey publicKey = (ECDSAPublicKey) keyService.getPublicKey(jwkUrl, kid); return new ECDSASigner(signatureAlgorithm, publicKey); } throw new HttpException(ErrorResponseCode.ALGORITHM_NOT_SUPPORTED); }