We have a service which periodically needs to update the set of known keys which will be used to sign requests. The simplest way I can see to allow this is to have

validationKeys :: JWKSet

become

validationKeys :: Either (IO JWKSet) JWKSet

or something isomorphic to this. For our particular use case this happens frequently enough that it would be better to not have to shoot the service in the head to periodically fetch the latest keys.