When using an external OAuth provider, we currently require the user to configure the public key as an environment variable.
Instead, we should fetch the key from a well-known URL.