code: def pick_keys(self, keys, use="", alg=""):
          
          if not alg:
              alg = self["alg"]
  
          if alg == "none":
              return []
  
          _k = self.alg2keytype(alg)
          if _k is None:
              logger.error("Unknown algorithm '%s'" % alg)
              raise ValueError('Unknown cryptography algorithm')
  
          logger.debug("Picking key by key type={0}".format(_k))
          _kty = [_k.lower(), _k.upper(), _k.lower().encode("utf-8"),
                  _k.upper().encode("utf-8")]
          _keys = [k for k in keys if k.kty in _kty]
          try:
              _kid = self["kid"]
          except KeyError:
              try:
                  _kid = self.jwt.headers["kid"]
              except (AttributeError, KeyError):
                  _kid = None
  
          logger.debug("Picking key based on alg={0}, kid={1} and use={2}".format(
              alg, _kid, use))
  
          pkey = []
          for _key in _keys:
              logger.debug(
                  "Picked: kid:{}, use:{}, kty:{}".format(
                      _key.kid, _key.use, _key.kty))
              if _kid:
                  if _kid != _key.kid:
                      continue
  
              if use and _key.use and _key.use != use:
                  continue
  
              if alg and _key.alg and _key.alg != alg:
                  continue
  
              pkey.append(_key)
  
          return pkey
docs: The assumption is that upper layer has made certain you only get
          keys you can use.
  
          :param alg: The crypto algorithm
          :param use: What the key should be used for
          :param keys: A list of JWK instances
          :return: A list of JWK instances that fulfill the requirements