- Replace resolveSigningAlgorithm with resolveSigningKey: resolves the
full key once and passes it to signJWT, eliminating redundant DB lookup
and key rotation race between alg resolution and signing
- Add ResolvedSigningKey type for the resolved key contract
- Validate signed ID token header alg against declared alg when using
custom jwt.sign callbacks (OIDC Core 3.1.3.6)
- Remove stale @ts-expect-error directives