How to verify signature using set of JWKS via https url?

[smartaquarius10]

How to verify signature using set of JWKS via https url?

[csstaub]

You need to be able to trust the keys you use for verification, that won’t work if you fetch them over HTTP. How do you know the keys haven’t changed during transmission?

[smartaquarius10]

@csstaub,
Hmm. But then how go jose is verifying signature. From where is it fetching the key sets.

[csstaub]

Go JOSE assumes that you have a trusted key already available to verify with. Fetching keys from third parties is out of scope of the library. Generally, Public-Key Infrastructure (PKI) is used to distribute & authenticate public keys, such as in the form of certificates. If you're having trouble understanding the trust calculus of key distribution schemes I would recommend seeking professional advice from a qualified security engineer.