Changelog entry

Author: jkarni

changelog.d/1580

@@ -0,0 +1,10 @@
+synopsis: Allow IO in validationKeys
+prs: #1580
+issues: #1579
+
+description: {
+
+Currently validationKeys are a fixed JWKSet. This does not work for setups such
+as AWS Cognito or Okta, where there is a regular key rotation. This change
+alters the type of validationKeys from JWKSet to IO JWKSet.
+}