I have a question (a critique one I guess). "JWT sign-in Key Rotations" is supposed to be done in the middleware auth validation right? (I am currently using Node Js lib)