| ExternalKeysProvider | Publishes the public halves of an IKeyCustodian's signing and encryption keys to the OIDC pipeline, one entry per current key version. It never returns private material: each key is public-only, which is the signal the crypto seam reads to route the private operation to the custodian by kid. Version-awareness rides the produce/publish split of IAuthServiceKeysProvider: every version is published (so a client can verify a signature or encrypt a JWE to any of them, and a rotation overlaps), while the ACTIVE version - the newest one past the server's KeyRolloverPropagation window - leads the set, so the produce role signs and encrypts with it. A freshly rotated version stays announced (published, trailing) until it clears the window, so a client that has not refreshed its JWKS cache never sees a token produced with a version it lacks. One provider serves any custodian, so the Vault and Azure packages carry no key provider of their own. |