There are different type of service account:
- JWT service account (the one your are supporting here)
- Compute based service account (that get the token from the metadata server)
- App Engine based service account (that get the token from the App Identity API)

Ideally `gcloud` would support all three, and select the best one according to the environment.