Signing-key rotation

Signing keys are tenant scoped. Rotation is a three-step operator workflow:

1. Stage a new key. It appears in the tenant JWKS before it signs new tokens.
2. Activate the staged key. Newly issued tokens use it while verifiers can resolve both old and new public keys.
3. Retire the previous key only after every token it signed can no longer be valid, including configured clock skew and caches.

Resource servers should refresh JWKS when they encounter an unknown key identifier and cache it according to HTTP semantics. They must still restrict algorithms and require the exact issuer and audience.

Private signing material is encrypted at rest and never returned by administration APIs.