Function verify_key_jwt 

pub(super) fn verify_key_jwt<'k>(
    state: &AppState,
    token: &str,
    iss: &str,
    lxm: &str,
    keys: &'k [String],
    now: OffsetDateTime,
) -> Result<KeyJwt<'k>, ApiError>

Checks a JWT whose iss is iss against keys: for this server, for lxm, exp in the future and at most MAX_PROOF_LIFETIME away, a jti of a bounded length, and signed by one of keys.