jwt key confusion