We want to add the ability of the proxy service to not have to fetch the most resent public signing key from LS login, but instead keep it cached for some time (reducing load on LS login JKU endpoint and provide improved response time for end-users like lega-commander client).
A failed authentication with a cached public key, should ideally trigger a fresh download from the JKU endpoint and retry this certificate, before rejecting authentication of the token.
Need to test that the token refresh is actually blocked and the cached token is used and that the token refresh happens once the cache is invalidated (time dependent)