We already have alternative forms of JWT validation in the application server but now Soteria bringing in nimbus-jose-jwt - could JWT validation be behind a common API allowing vendors to choose their implementation.