code: public VerificationKeyResponse getKey(Principal principal) {
          KeyInfo key = keyInfoService.getActiveKey();
          if (!includeSymmetricalKeys(principal) && !RSA.name().equals(key.type())) {
              throw new AccessDeniedException("You need to authenticate to see a shared key");
          }
          return getVerificationKeyResponse(key);
      }
docs: Get the verification key for the token signatures. The principal has to
  be provided only if the key is secret
  (shared not public).
  
  @param principal the currently authenticated user if there is one
  @return the key used to verify tokens