Security: The server's public key can be downloaded directly (https:) so does not use REST bindings.