Fetches the public keys that can be used to verify JWTs signed by Prolific. Clients should cache these keys and update them at least daily.

To verify the signature of a JWT you must verify the following:

• The JWT signature is authentic by verifying it with the public key from Prolific that correlates with the KID.
• The JWT hasn't expired, by checking the exp claim.
• The aud claim is the correct domain for your tool.
• The prolific claim matches your expected payload as set in the external_study_url property. It always includes PROLIFIC_PID, STUDY_ID, SESSION_ID, and workspace_id. When the workspace is linked to an organisation, it also includes organisation_id.