In order to facilitate key rotation, without using a kid or other explicit claim, the keyfunc should be allowed to return a slice of eligible keys, and then the verifier will try each in turn until success or running out of keys.

It would be pretty simple to make it backwards compatible with the current usage of returning a single key.