Just as a note, the certs location isn't part of discovery at all - it's part of the OAuth/OpenID Connect infrastructure. So discovery shouldn't get involved in this case - the endpoint should be considered to be well known.