Issuer trust Current ES256 issuer key for Chit402 receipts: the JWKS URL, the kid (RFC 7638 thumbprint), and how to run chit402-verify. The private key is never published.