The SVA platform's public OIDC issuer moved to
https://oidc.svasys.com on 2026-09-08.
Discovery:
https://oidc.svasys.com/.well-known/openid-configuration
JWKS: https://oidc.svasys.com/jwks.json
(note the .json — /jwks is not served)
The key set published at this host was last written 2026-06-09 and its
kid no longer matched the platform's signing key, so it could not
verify current tokens. The files were removed rather than updated so that a
stale pin fails loudly with a 404 instead of silently failing verification.
Read jwks_uri out of the discovery document rather than
hardcoding a path; that is what makes the next move survivable.