Returns the current JWKS for verifying platform-signed JWTs.

Webhook validation instructions:

Required:

1. Decode the JWT header to find the kid (key ID).
2. Fetch the matching public key from the JWKS endpoint.
   Production: https://fobm-messaging.fo-prdeng-prod.com/.well-known/jwks.json
3. Verify the JWT signature using PS256 (RSASSA-PSS with SHA-256).

The above steps are sufficient for basic token validation.

Optional (additional validation, if desired):
4. Extract the pbh claim from the JWT — this is a Base64URL-encoded SHA-256 hash of the webhook body.
5. Compute your own SHA-256 hash of the raw request body and ensure it matches the pbh claim.
6. Validate other claims:

• iss should be "firstorion.com"
• aud should match the agent webhook URL
• exp / iat should be within a 5-minute window

Reject any request with an invalid signature, mismatched pbh, or expired token.