Applications need to publish, rotate, and deactivate signing keys with automatic JWKS endpoint updates