I skimmed over the previous articles in this blog and they don't seem to mention the one use case JWTs were made for: having a separate authentication server from the application server. Most developers will only need this for integrating into corporations with single sign in or social logins (sign in with Facebook/google/apple...). There you won't write the authentication server but integrate with them. Session Ids are dead simple to get right securely. Just use them.
Maybe missed something.
Private key redis key
public static string PrivateKey(string kid) => $"{Root}:jwks:private:{kid}"; // full private material (short life)Would have been good if the article example showed a Redis server with TLS and password auth.
This is a hard tradeoff between availability and compliance. If the cloud service goes down or you have an internet issue, you would lose the ability to sign any new tokens. This is a fairly fundamental aspect of infrastructure so it's worth considering if you absolutely must put it across the wire.
You never have the private key, only the ability to ask something to encrypt/sign something