title: Clarification need while parsing the jwt token
body: <p>The Authorization server exposes the <code>JWKS</code> endpoint. So anyone can access the <code>JWKS</code> endpoint. The <code>JWKS</code> endpoint contains the details to construct the <code>public-key</code> which can then be used to verify the signature and extract the data.</p>
  <p>Then, in this case,</p>
  <ol>
  <li>Any client can access the jwks and verify the signature</li>
  <li>Where is the private key in this flow? Is it on the OAuth server?</li>
  </ol>