JSON Web Key Set

Public key directory for Beltic-issued credentials. Verifiers fetch this to validate JWT signatures. Supports multiple keys to handle rotation: keys marked active are used for new signatures, while next and retired keys remain available to verify credentials signed by prior keys.

Cache-Control: max-age=3600 — verifiers should cache.