<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
What are the expectations around the jwks_uri? The TransmitterConfiguration must list the URI where you can get the JWKS, but nothing is said in the spec about how or whether we should secure that URI. Since all of the security of the SETs being sent from the
Transmitter is held in that JWKS value, should we be specific about how to secure that endpoint? Or do we leave that up to the Transmitter to decide?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
- Shayne</div>
<div class="elementToProof">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<table style="box-sizing: border-box; border-collapse: collapse; border-spacing: 0px; max-width: 100%; font-family: "Helvetica Neue", Helvetica, Arial, sans-serif; font-size: 12px; text-align: start; color: rgb(51, 51, 51);">
<tbody style="box-sizing:border-box">
<tr style="box-sizing:border-box">
<td width="50" style="box-sizing:border-box"><img style="max-width:100%" data-outlook-trace="F:1|T:1" src="cid:168a1c43-b2ae-49fa-ada4-ff44041b08be"><br>
</td>
<td width="10" style="box-sizing:border-box"><img width="10" height="50" style="box-sizing: border-box; vertical-align: middle; display: block; width: 10px; height: 50px; max-width: initial;" src="https://duo.com/assets/img/email/spacer.gif"></td>
<td style="box-sizing:border-box">
<div style="box-sizing:border-box; margin:0px; font-family:Helvetica,sans-serif; display:inline">
<strong style="box-sizing:border-box; font-weight:bold; display:inline">Shayne Miel</strong><span> </span>
<div style="box-sizing:border-box; margin:0px; display:inline"><span style="box-sizing: border-box; color: rgb(153, 153, 153);">/</span><span> </span><span style="box-sizing:border-box">Principal Engineer (he, him, his)</span></div>
<div style="box-sizing:border-box; margin:0px; display:inline"><br style="box-sizing:border-box">
<a href="mailto:smiel@cisco.com" style="box-sizing: border-box; color: rgb(99, 178, 70);" data-loopstyle="link"><span style="color: rgb(23, 78, 134);">smiel@cisco.com</span></a></div>
<div style="box-sizing:border-box; margin:0px; display:inline"><br style="box-sizing:border-box">
<span style="box-sizing:border-box">(919) 923-6230</span><span style="box-sizing:border-box"></span></div>
<div style="box-sizing:border-box; margin:0px; display:inline"><br style="box-sizing:border-box; display:inline">
<a href="https://www.cisco.com/site/us/en/products/security/index.html" title="https://www.cisco.com/site/us/en/products/security/index.html" data-loopstyle="link"><span style="color: rgb(23, 78, 134);">cisco.com</span></a><br>
</div>
</div>
</td>
<td style="box-sizing:border-box"><img width="1" height="50" style="box-sizing:border-box; vertical-align:middle; display:block" src="https://duo.com/assets/img/email/spacer.gif"></td>
</tr>
<tr style="box-sizing:border-box">
<td colspan="4" style="box-sizing:border-box"><br>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>