It boggles my mind that Apple’s market position allows it to pocket $18 billion a year in pure rent for this real estate on its platform and the company paying is the one that gets an antitrust suit.
By downloading a shared key over TLS rather than the provider's public key?
No difference from the perspective of the token consumer. From the perspective of they token generator, it means rotating per-tenant keys rather than a single keypair.
Also, issuing servers and verifying servers don't even need to be part of the same organization, allowing you to outsource credential management (see Auth0, Firebase Authentication).