Verifies JWT signatures against a JWKS endpoint, a PEM URL, a static key or (opt-in) a shared HMAC secret; enforces exp/nbf/iss/aud, scopes and optional jti replay protection; caches key material, handles key rotation, and exposes the verified claims to the application through the Rack environment. Pairs with the jwt_auth_client gem.