small documentation  update
# NB: this can be overridden on a per-OP basis in the .conf file using the key: auth_request_method
# OIDCProviderAuthRequestMethod [ GET | POST ]
-# The fully qualified names of the files that contain the PEM-formatted X.509 certificates
+# The fully qualified names of the files that contain the PEM-formatted RSA Public key or a X.509 certificates
# that contain the RSA public keys to be used for JWT (OP state/id_token) encryption by the OP.
-# These keys must correspond to the private keys defined in OIDCPrivateKeyFiles.
+# One of these keys must correspond to the private keys defined in OIDCPrivateKeyFiles.
# When not defined no encryption will be requested.
# You can also prefix <filename> with a JWK key identifier to manually override the automatically
# generated "kid" that will be used for this key in the JWKs derived from this certificate and
