Rework IDP validation according to the RFC, fix public_key tests