"JwksTrustStore.Get" assigned each parsed key to the function's named return value while refreshing the JWKS cache. When the requested "kid" was not present, the trailing naked "return" handed the caller the last key in the JWKS document together with a "nil" error — a confidently wrong answer instead of "not found".