Function jwks_client 

async fn jwks_client(
    state: &AppState,
    issuer: &str,
    jwks_uri: &str,
) -> Result<Client, ApiError>

The client the issuer’s key set is fetched through. Discovery may put the keys on another host — Google’s sit on www.googleapis.com — so that host is checked and pinned the way the issuer’s was. The URL keeps the issuer’s scheme and carries no credentials: https://issuer@host/ is a fetch from host, whatever it begins with.