use jwks_uri instead of jwk_signing_key