Currently, PIA runs OIDC key discovery on each request, which adds two additional roundtrips to the issuer's .well_known endpoint. Given that keys don't change that often, we should cache them for a reasonable amount of time. Consider warehouse's _refresh_keyset for inspiration.
Currently, PIA runs OIDC key discovery on each request, which adds two additional roundtrips to the issuer's
.well_knownendpoint. Given that keys don't change that often, we should cache them for a reasonable amount of time. Consider warehouse's_refresh_keysetfor inspiration.