Get JWKS (public key set)

Returns the JSON Web Key Set containing InsumerAPI's two public signing keys. Use this to verify attestation and trust-profile signatures without hardcoding a key. Five entries are published. Three kid labels point at the SAME ECDSA P-256 key: insumer-attest-v1 (v1 attest, v1 trust, and all commerce discount responses regardless of key generation), insumer-attest-v2 (v2 attest), insumer-trust-v2 (v2 trust). They are followed by two RFC 9964 AKP entries for the ML-DSA-65 post-quantum signature key, insumer-attest-pq1 and insumer-trust-pq1, appended after the EC entries. Resolve the key by the kid (or pqKid) on the response you are verifying, never by position; an unknown kid is unverifiable, not refuted. The kid also tells you which verification rules to apply (see the sig notes on /v1/attest). Keys are never removed: a rotated key stays in this set permanently under its original kid, so attestations kept as records remain verifiable. No authentication required. Cached for 24 hours.