I'd asked this question before, but it's probably more appropriate for this developers' forum.
I've configured an LTI key in Canvas with a URL in the "Public JWK URL" field. After inspecting the traffic to my server, I see that Canvas never requests that URL. However, the tool works fine. How can this be?
The JWK keys are only currently used for LTI Advantage services (eg Names and Roles Provisioning Service, https://canvas.instructure.com/doc/api/names_and_role.html), to just launch a tool you don't need a JWK key in your tool, just to validate the launch with the JWKs keys that Canvas is configured with ( eg https://canvas.instructure.com/api/lti/security/jwks )
Thank you very much. That makes sense. I need to find some documentation of the LTI lifecycle. I probably wouldn't have even asked this question if I knew which documentation to RTFM. 🙂