I'm not sure what the issue is - sounds like several.

Issues seem to be:

1.) "we should[n't] allow OAuth2Client to discover an API" - Sorry I really don't understand what you mean by 'discover an API' and I don't know which API you are referring to.

2.) People calling the service too often? The Cache should take care of this and will respect the cache-control set by the cert server. 

3.) People wanting to control the cache themselves? Would a parameter to not cache be acceptable? My main concern with such an approach is someone doesn't cache this and considering it's for a set of certificates I do not expect to change, feels a bit odd to not take care of it.

4.) "It's racy to discover any API right before a call" - Sorry, again I can't follow what you are referring to here - what 'API' are we talking about, the verifyIdToken(), the getFedereatedSignonCerts method, the call to the CERTS URL....?