Asymmetric keys that sign tokens. Spokes validate via the published JWKS — rotate without downtime.
0