code: public VerificationKeysListResponse getKeys(Principal principal) {
          boolean includeSymmetric = includeSymmetricalKeys(principal);
          Map<String, KeyInfo> keys = keyInfoService.getKeys();
          List<VerificationKeyResponse> keyResponses = keys.values().stream()
                  .filter(k -> includeSymmetric || RSA.name().equals(k.type()))
                  .map(TokenKeyEndpoint::getVerificationKeyResponse)
                  .collect(Collectors.toList());
          return new VerificationKeysListResponse(keyResponses);
      }
docs: Get the verification key for the token signatures wrapped into keys array.
  Wrapping done for compatibility with some clients expecting this even for single key, like mod_auth_openidc.
  The principal has to be provided only if the key is secret
  (shared not public).
  
  @param principal the currently authenticated user if there is one
  @return the key used to verify tokens, wrapped in keys array