I'm currently trying to use IdentityServer4 to build a single-signon experience for my users across different apps I have. They are all hosted in the same local network and no third-party apps authenticate with it. The client apps are still Katana/Owin-based.

I'm using the implicit workflow.

At the moment I still use a certificate randomly generated at runtime to sign tokens.

I wonder

* whether I actually need more and what the implications are of leaving it as it is and
* how the signature is actually validated by clients.

To the second question I found this piece in the openidconnect spec:

> 
> The OP advertises its public keys via its Discovery document, or may
>  supply this information by other means. The RP declares its public
>  keys via its Dynamic Registration request, or may communicate this
>  information by other means.
> 
> 
> 

So does that mean Katana is actually getting the public keys from IdentityServer4 and validates accordingly? And if so, would it matter if it the certificate changes? The time between issuing and validating a token is always very small, correct? So why would I need a proper, rarely-changing certificate?