Design a zero-downtime strategy for rotating the JWT signing key used by your Authorization Server.

Publish signing keys via a JWKS endpoint containing MULTIPLE keys, each tagged with a 'kid' (key ID). Introduce the new key alongside the old one first (both published), start signing NEW tokens with the new key while resource servers continue accepting tokens signed by either key (matched via 'kid'), and only remove the old key from JWKS once all tokens signed with it have naturally expired — avoiding any window where valid tokens are suddenly rejected.