JwksFetch

jwksfetch is a single Native AOT executable (no .NET runtime required) that retrieves a public JSON Web Key from a remote JWKS endpoint or via OIDC discovery, then emits the key in PEM format to stdout. Designed as a companion to jwtdecode: pipe jwksfetch output directly into jwtdecode --verify --key-file - for end-to-end offline JWT verification after an initial key fetch.