code: private boolean tryCreateSignatureVerifier() {
          long t = System.currentTimeMillis();
          if (t - lastKeyFetchTimestamp < oAuth2Properties.getSignatureVerification().getPublicKeyRefreshRateLimit()) {
              return false;
          }
          try {
              SignatureVerifier verifier = signatureVerifierClient.getSignatureVerifier();
              if (verifier != null) {
                  setVerifier(verifier);
                  lastKeyFetchTimestamp = t;
                  log.debug("Public key retrieved from OAuth2 server to create SignatureVerifier");
                  return true;
              }
          } catch (Throwable ex) {
              log.error("could not get public key from OAuth2 server to create SignatureVerifier", ex);
          }
          return false;
      }
docs: Fetch a new public key from the AuthorizationServer.
  
  @return true, if we could fetch it; false, if we could not.