Constant DPOP_SKEW 

const DPOP_SKEW: Duration;

How far a DPoP proof’s iat may sit from this server’s own clock, either direction — and, per dpop::DpopVerifier::new’s own doc, also how long a jti is retained in the replay cache, since the two are the same number for the reason named there. Matches token::ACCESS_TTL: a proof need only stay fresh for about as long as the token it mints or presents is good for.