Public keys for verifying the RS256 signature on a certificate’s
proof.jwt, in the JWK Set format of RFC 7517.
Keys are stable across certificate issuance, so a client can cache the
set and verify certificates offline. Match the JWT header’s kid
against the kid of a key in the set.
The payload’s domain claim is the store domain the certificate was
issued for; compare it against the page’s domain to reject a
certificate copied onto another site.
