title: Validate Signature of JWT that doesn't contain the 'kid' Header
body: <p>The IdP I'm working with signs JWTs without adding the Key ID ('kid') header.</p>
  <p>Additionally, keys are rotated quickly.</p>
  <p>The <a href="https://datatracker.ietf.org/doc/html/rfc7517#page-8" rel="nofollow noreferrer">JWT RFC</a> says that the KID is indeed optional, but I can't seem to wrap my head around how I'm implementing proper signature validation without iterating through all keys that are returned from my IdPs JWKS URL and trying them out blindly.</p>
  <p>Also I'm using <a href="https://github.com/auth0/node-jwks-rsa" rel="nofollow noreferrer">jwks-rsa</a> that only supports <code>getSigningKey(&lt;kid&gt;)</code>.</p>
  <p>I appreciate any hint about what's the proper approach here!</p>