jws and attribute bundle changes

use RSA, include key info (jku and kid), publish jwk set
other: encrypt verification PIN in twilio phone call url