protected PublicJsonWebKey getJsonWebKeySigningKeyFrom(final JsonWebKeySet jwks,
                                                           final Optional<OAuthRegisteredService> serviceResult) throws Throwable {
        FunctionUtils.throwIfNull(jwks,
            () -> new IllegalArgumentException("JSON web keystore is empty and contains no keys"));
        val jsonWebKeys = jwks.getJsonWebKeys();
        LOGGER.trace("JSON web keystore contains [{}] key(s)", jsonWebKeys);

        val finalKey = serviceResult
            .filter(OidcRegisteredService.class::isInstance)
            .map(OidcRegisteredService.class::cast)
            .stream()
            .filter(oidcService -> StringUtils.isNotBlank(oidcService.getJwksKeyId()))
            .map(oidcService -> jsonWebKeys
                .stream()
                .filter(PublicJsonWebKey.class::isInstance)
                .filter(key -> StringUtils.equalsIgnoreCase(key.getKeyId(), oidcService.getJwksKeyId()))
                .map(PublicJsonWebKey.class::cast)
                .findFirst())
            .flatMap(Optional::stream)
            .findFirst();

        LOGGER.debug("Located key [{}] for service [{}]", finalKey, serviceResult);
        return finalKey.orElseGet(() -> (PublicJsonWebKey) jsonWebKeys.getFirst());
    }
This is {@link BaseOidcJsonWebKeyTokenSigningAndEncryptionService}.

@author Misagh Moayyed
@since 6.1.0
support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/BaseOidcJsonWebKeyTokenSigningAndEncryptionService.java