code: @Override
      protected Map<String, Object> decode(String token) {
          try {
              //check if our public key and thus SignatureVerifier have expired
              long ttl = oAuth2Properties.getSignatureVerification().getTtl();
              if (ttl > 0 && System.currentTimeMillis() - lastKeyFetchTimestamp > ttl) {
                  throw new InvalidTokenException("public key expired");
              }
              return super.decode(token);
          } catch (InvalidTokenException ex) {
              if (tryCreateSignatureVerifier()) {
                  return super.decode(token);
              }
              throw ex;
          }
      }
docs: Try to decode the token with the current public key.
  If it fails, contact the OAuth2 server to get a new public key, then try again.
  We might not have fetched it in the first place or it might have changed.
  
  @param token the JWT token to decode.
  @return the resulting claims.
  @throws InvalidTokenException if we cannot decode the token.