Design JWT caching strategy

[rubenhensen]

Description

JWT caching is currently disabled. We need to design a proper caching strategy before re-enabling it. There are several open questions to resolve.

Open questions

• Auto-signing: Do we want to automatically sign with cached credentials? Is that a privacy concern?
• Cache duration: How long should JWTs be cached?
• Multiple identities: How do we handle caching when switching between sender addresses (e.g., x@example.com vs y@example.com)?
• Varying attribute sets: How do we handle cases where the same email signs with different attribute combinations? (e.g., signing with just x@example.com one time, and x@example.com + birthday attribute another time)

Goal

Design and implement a caching strategy that handles all these edge cases correctly without compromising user privacy or causing unexpected behavior.