The JWT may not be an id_token hence it might not contain an iss claim.
Use the default kid if specified.
When decrypting/verifying something use client id in the request to chose usable keys.