It checks only the first key/certificate

[Nordes]

The resolve(JSON.parse(jwksResponse.body).keys[0].x5c[0]) will only check with one certificate. If we have many it will fail. So when we update the certificate thing, it will fail on the long run. (We should allow 24 hours for the server to refresh the key from the server and during that time we will have more than one key).

See doc on Identity Server 4.