Allow jwks uri or jwks json for signature verification

[juancgalvis]

Hi, we want to use your web site with a token and jwks, so your site may identify the key id from 'kid' header and extract it from the jwks, the jwks may be set as another json input or an url input that loads it (may fails cors by this reason the json input is proposed)

What do you think about it?