2 min lesson
Rotation, revocation & secrets
Answer "Why publish a JWKS endpoint with kid headers instead of just hard-coding the current signing key in every verifier?" Use one lesson detail to support it.
Step 1 of 4
Auth that's secure on launch day and never rotates a key is auth waiting for a breach. The lifecycle - keys, refresh tokens, secrets and a breach plan - is what separates an EM who has operated auth from one who has only diagrammed it.