| AzureBlobKeyRingOptions | Points the key ring at an Azure Blob Storage container, one blob per key. |
| AzureKeyRingTransport | The HTTP transport the key ring's blob calls travel on. |
| AzureKeyVaultOptions | Points the custodian at an Azure Key Vault: which vault and how to authenticate to it, and nothing about which keys to use. Which keys, and therefore whether their private halves ever enter this process, is the placement choice that follows the custodian registration. |
| AzureKeyVaultTransport | The HTTP transport the custodian's Key Vault calls travel on. |
| KeyVaultClient | Thin wrapper over the Azure Key Vault SDK. Signing and unwrapping run inside the vault against a key whose private half never leaves it, so this type only moves bytes across the boundary. The Azure SDK is pointed at the host's System.Net.Http.IHttpClientFactory transport (like the Vault client), so it inherits the host's HTTP handlers, logging and pooling. A Azure.Security.KeyVault.Keys.Cryptography.CryptographyClient is cached per key name because creating one resolves the key's metadata on first use. |
| ServiceCollectionExtensions | Registers the Azure Key Vault custodian for any host that signs or decrypts JSON Web Tokens, whether or not it is an OpenID Provider. |