mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-09 13:35:12 +09:00
ServerKit Cloud mints each signing key the first time it is used and rotates keys on its own schedule, so a command can legitimately arrive signed with a key the connection's cached JWKS predates. The panel used to refuse it as untrusted; it now refetches the JWKS once on an unknown kid and only refuses a key that is still unknown afterwards.