Require kid in protected header, and use it upon verify.