Currently, when verifying a signature (like the id token signature), a new HTTP request is executed to download the JWKSet.
It should ideally be cached (and refreshed regularly to avoid being out of date).
