Support x509 Certificates for JWT verification.

If an attempt to parse the pubkey as PKIX fails, try again as
x509.Certificate. Some vendors are starting to use these to sign JWTs.
Example: https://www.googleapis.com/oauth2/v1/certs