fixed blacklisted field name, addresses #295
switched signing & validation service to use JWK natively for keys
made signing and verification service construction safe for public-only keys