Kong: the jwt plugin verifies a token, it does not issue one

curl -X POST http://localhost:8001/routes/api/plugins \
  --data name=jwt \
  --data 'config.claims_to_verify[]=exp'

# register the issuer's public key against a consumer
curl -X POST http://localhost:8001/consumers/acme/jwt \
  --data algorithm=RS256 \
  --data rsa_public_key@public.pem \
  --data key=https://issuer.example.com     # must equal the token's `iss`

curl http://localhost:8000/api -H "Authorization: Bearer $TOKEN"

Valid:    200, X-Consumer-Username: acme
Expired:  401 {"exp":"token expired"}
Bad sig:  401 {"message":"Invalid signature"}

# The `key` field is the join: Kong reads the token's iss claim and looks up
# the credential whose key matches it. A mismatch gives
# "No credentials found for given 'iss'" even with a perfectly valid token.
#
# For full OIDC (discovery, introspection, refresh) you need the Enterprise
# openid-connect plugin.