.NET/C#中JWT签名验证失败：Token含KID但与配置不匹配

IDX10503: Signature validation failed. Token does not have a kid. Keys tried: 'Microsoft.IdentityModel.Tokens.X509SecurityKey, KeyId: 'T1St-dLTvyWRgxB_676u8krXS-I', InternalId: 'T1St-dLTvyWRgxB_676u8krXS-I'. , KeyId: T1St-dLTvyWRgxB_676u8krXS-I
'. Number of keys in TokenValidationParameters: '1'.
Number of keys in Configuration: '0'.

验证功能的核心代码如下：

string stsDiscoveryEndpoint = "https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration";
ConfigurationManager<OpenIdConnectConfiguration> configManager = new ConfigurationManager<OpenIdConnectConfiguration>(stsDiscoveryEndpoint, new OpenIdConnectConfigurationRetriever());
OpenIdConnectConfiguration config = configManager.GetConfigurationAsync().Result;

TokenValidationParameters validationParameters = new TokenValidationParameters
{
    ValidAudience = "XXX",
    ValidIssuer = "XXX",
    ValidateAudience = true,
    ValidateIssuer = true,
    IssuerSigningKey = config.SigningKeys.FirstOrDefault(),
    ValidateLifetime = true
};

JwtSecurityTokenHandler tokendHandler = new JwtSecurityTokenHandler();
SecurityToken jwt;
tokendHandler.ValidateToken(token, validationParameters, out jwt);

解码待验证的Access Token后，发现其头部包含KID，但与配置中获取到的KID不一致：

{
    "typ": "JWT",
    "alg": "RS256",
    "kid": "5B3nRxtQ7ji8eNDc3Fy05Kf97ZE"
}

相关疑问：

• 该问题是否与内存中缓存的旧签名密钥（比如昨日的）不同步有关？
• 如果是缓存问题，如何清除配置中的签名密钥缓存？

内容的提问来源于stack exchange，提问作者MatDDev