Module validator 

Token validation and delegation-chain verification.

Structs

IdentityValidator

The validator: keyed by kid, audience-bound, and optionally issuer-allowlisted (opt in via IdentityValidator::allow_issuers; with no allowlist configured, any issuer is accepted).

ValidatedIdentity

A successfully validated identity.

Enums

IdentityError

Identity validation failures.

KeyMaterial

Verification key material, bound to a kid.