private static JWSVerifier getVerifier(JWSHeader header, JWK jwk) throws JOSEException {
    Preconditions.checkArgument(jwk instanceof AsymmetricJWK,
        "JWT signature verification with symmetric key is not allowed.");
    Key key = ((AsymmetricJWK) jwk).toPublicKey();
    return JWS_VERIFIER_FACTORY.createJWSVerifier(header, key);
  }
This class is used to validate JWT. JWKS is fetched during instantiation and kept in the memory.
We disallow JWT signature verification with symmetric key, because that means anyone can get the same key
and use it to sign a JWT.
This is cloned from JWTValidator in HS2 so as to NOT have any dependency on HS2 code.
standalone-metastore/metastore-server/src/main/java/org/apache/hadoop/hive/metastore/auth/jwt/JWTValidator.java