Fetch the credential issuer's public keys (JWKS)

The credential issuer's published public keys as an RFC 7517 JSON Web Key Set — the same rotation set the DID document carries, for verifiers that consume a JWKS directly. Unauthenticated; cacheable for one hour.