Fetch the issuer’s public JWKS, verify the signature, walk the delegation chain, and evaluate the mandate against what is being asked. You hold no credential from us to do any of it; the key is public and the whole check runs on your side.