Code review comment: @c15yi ok, a jose4j instance for verifying a signature can be built manually for this case with some custom basic resolver delegating to your new method,  but I can take care of it later

Code under review:
public Uni<VerificationKeyResolver> resolve(TokenCredential tokenCred) {
        JsonObject headers = OidcUtils.decodeJwtHeaders(tokenCred.getToken());
        Key key = findKeyInTheCache(headers);
        if (key != null) {
            return Uni.createFrom().item(new SingleKeyVerificationKeyResolver(key));
        }
        if (chainResolverFallback != null && headers.containsKey(HeaderParameterNames.X509_CERTIFICATE_CHAIN)
                && Collections.disjoint(KEY_HEADERS, headers.fieldNames())) {
            
            
            return getChainResolver();
        }

        return client.getJsonWebKeySet(new OidcRequestContextProperties(
                Map.of(OidcRequestContextProperties.TOKEN, tokenCred.getToken(),
                        OidcRequestContextProperties.TOKEN_CREDENTIAL, tokenCred)))
                .onItem().transformToUni(new Function<JsonWebKeySet, Uni<? extends VerificationKeyResolver>>() {

                    @Override
                    public Uni<? extends VerificationKeyResolver> apply(JsonWebKeySet jwks) {
                        Key newKey = null;
                        
                        String kid = headers.getString(HeaderParameterNames.KEY_ID);
                        if (kid != null) {
                            newKey = getKeyWithId(jwks, kid);
                            if (newKey == null) {
                                
                                return Uni.createFrom().failure(
                                        new UnresolvableKeyException(String.format("JWK with kid '%s' is not available", kid)));
                            } else {
                                cache.add(kid, newKey);
                            }
                        }

                        String thumbprint = null;
                        if (newKey == null) {
                            thumbprint = headers.getString(HeaderParameterNames.X509_CERTIFICATE_SHA256_THUMBPRINT);
                            if (thumbprint != null) {
                                newKey = getKeyWithS256Thumbprint(jwks, thumbprint);
                                if (newKey == null) {
                                    
                                    return Uni.createFrom().failure(
                                            new UnresolvableKeyException(String.format(
                                                    "JWK with the SHA256 certificate thumbprint '%s' is not available",
                                                    thumbprint)));
                                } else {
                                    cache.add(thumbprint, newKey);
                                }
                            }
                        }

                        if (newKey == null) {
                            thumbprint = headers.getString(HeaderParameterNames.X509_CERTIFICATE_THUMBPRINT);
                            if (thumbprint != null) {
                                newKey = getKeyWithThumbprint(jwks, thumbprint);
                                if (newKey == null) {
                                    
                                    return Uni.createFrom().failure(new UnresolvableKeyException(
                                            String.format("JWK with the certificate thumbprint '%s' is not available",
                                                    thumbprint)));
                                } else {
                                    cache.add(thumbprint, newKey);
                                }
                            }
                        }

                        if (newKey == null && kid == null && thumbprint == null) {
                            newKey = jwks.getKeyWithoutKeyIdAndThumbprint("RSA");
                        }







                        if (newKey == null && chainResolverFallback != null) {
                            return getChainResolver();
                        }

                        if (newKey == null) {
                            return Uni.createFrom().failure(new UnresolvableKeyException(
                                    "JWK is not available, neither 'kid' nor 'x5t
                        } else {
                            return Uni.createFrom().item(new SingleKeyVerificationKeyResolver(newKey));
                        }
                    }

                });
    }


Revised code:
public Uni<VerificationKeyResolver> resolve(TokenCredential tokenCred) {
        JsonObject headers = OidcUtils.decodeJwtHeaders(tokenCred.getToken());
        Key key = findKeyInTheCache(headers);
        if (key != null) {
            return Uni.createFrom().item(new SingleKeyVerificationKeyResolver(key));
        }
        if (chainResolverFallback != null && headers.containsKey(HeaderParameterNames.X509_CERTIFICATE_CHAIN)
                && Collections.disjoint(KEY_HEADERS, headers.fieldNames())) {
            
            
            return getChainResolver();
        }

        return client.getJsonWebKeySet(new OidcRequestContextProperties(
                Map.of(OidcRequestContextProperties.TOKEN, tokenCred.getToken(),
                        OidcRequestContextProperties.TOKEN_CREDENTIAL, tokenCred)))
                .onItem().transformToUni(new Function<JsonWebKeySet, Uni<? extends VerificationKeyResolver>>() {

                    @Override
                    public Uni<? extends VerificationKeyResolver> apply(JsonWebKeySet jwks) {
                        Key newKey = null;
                        
                        String kid = headers.getString(HeaderParameterNames.KEY_ID);
                        if (kid != null) {
                            newKey = getKeyWithId(jwks, kid);
                            if (newKey == null) {
                                
                                return Uni.createFrom().failure(
                                        new UnresolvableKeyException(String.format("JWK with kid '%s' is not available", kid)));
                            } else {
                                cache.add(kid, newKey);
                            }
                        }

                        String thumbprint = null;
                        if (newKey == null) {
                            thumbprint = headers.getString(HeaderParameterNames.X509_CERTIFICATE_SHA256_THUMBPRINT);
                            if (thumbprint != null) {
                                newKey = getKeyWithS256Thumbprint(jwks, thumbprint);
                                if (newKey == null) {
                                    
                                    return Uni.createFrom().failure(
                                            new UnresolvableKeyException(String.format(
                                                    "JWK with the SHA256 certificate thumbprint '%s' is not available",
                                                    thumbprint)));
                                } else {
                                    cache.add(thumbprint, newKey);
                                }
                            }
                        }

                        if (newKey == null) {
                            thumbprint = headers.getString(HeaderParameterNames.X509_CERTIFICATE_THUMBPRINT);
                            if (thumbprint != null) {
                                newKey = getKeyWithThumbprint(jwks, thumbprint);
                                if (newKey == null) {
                                    
                                    return Uni.createFrom().failure(new UnresolvableKeyException(
                                            String.format("JWK with the certificate thumbprint '%s' is not available",
                                                    thumbprint)));
                                } else {
                                    cache.add(thumbprint, newKey);
                                }
                            }
                        }

                        if (newKey == null && kid == null && thumbprint == null) {
                            newKey = jwks.getKeyWithoutKeyIdAndThumbprint("RSA");
                        }

                        
                        
                        
                        
                        

                        if (newKey == null && chainResolverFallback != null) {
                            return getChainResolver();
                        }

                        if (newKey == null) {
                            return Uni.createFrom().failure(new UnresolvableKeyException(
                                    "JWK is not available, neither 'kid' nor 'x5t
                        } else {
                            return Uni.createFrom().item(new SingleKeyVerificationKeyResolver(newKey));
                        }
                    }

                });
    }