By: Tom Sydney Kerckhove <syd@cs-syd.eu>
Do the whole check, against every issuer at once A caller had to write the same four steps itself: which issuer the token names, that issuer's settings and keys, the key the header names, and then the token. Doing it here means the issuers can be a map keyed by what they call themselves, which is the only thing a token offers before anything about it has been checked. Settling the issuers is separate from starting them, so a service can refuse settings that name one issuer twice before it starts rather than silently reaching only one of the two. Ord on Issuer is what the map needs. Ord on Audience and Algorithm are the same promise to a caller who wants a Set of either, and weeder cannot see a use that is not in this repo, so they are roots.