refactor(flags): reduce signed overrides to what the toolbar ships

Keep the v4 cookie and public API unchanged and only route signed tokens
through a small ES256 verifier, accepted alongside FLAGS_SECRET tokens.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: luismeyer

.changeset/kms-signed-overrides.md

@@ -2,8 +2,6 @@
 "flags": minor
 ---
 
-Accept flag override tokens which Vercel signs, alongside tokens of the `FLAGS_SECRET`, so the Vercel Toolbar can override flags with tokens signed by Vercel.
+Accept flag overrides which the Vercel Toolbar signs with Vercel KMS, so overrides work on Vercel without a `FLAGS_SECRET`.
 
-- On Vercel, or with a linked project (`VERCEL` or `VERCEL_OIDC_TOKEN` is set), the SDK verifies signed tokens (JWS) in the `vercel-flag-overrides` cookie with the public keys of Vercel, whether or not a `FLAGS_SECRET` is set. The keys are cached in memory.
-- Tokens encrypted with the `FLAGS_SECRET` (JWE) keep working exactly as before.
-- Adds `verifyOverrides`, which accepts both kinds of tokens.
+On Vercel, or locally after `vercel env pull`, the SDK verifies signed override tokens with the public keys of Vercel, which it keeps in memory. Tokens encrypted with the `FLAGS_SECRET` keep working exactly as before. The cookie is still `vercel-flag-overrides`.

packages/flags/src/index.ts

@@ -10,7 +10,6 @@ export {
   verifyAccessProof,
 } from './lib/crypto';
 export { mergeProviderData } from './lib/merge-provider-data';
-export { verifyOverrides } from './lib/overrides';
 export { reportValue } from './lib/report-value';
 export { safeJsonStringify } from './lib/safe-json-stringify';
 export { setTracerProvider } from './lib/tracing';