The failure mode: you rotate the JWT signing key, your verifier fetches the public key with no version, gets only the new one, and every token minted just before rotation suddenly fails signature checks. Fix it by requesting version all and keeping the previous keys: the response carries the newest key at result.current_version.public and older ones in the version array, so your verifier accepts tokens from both sides of the rotation. Same rule applies to secrets and rotated Pangea API tokens: an unversioned get silently moves to the newest version, which is what you want for reads but the wrong assumption when you are debugging why something that worked an hour ago stopped.

Context: Official docs (Pangea Cloud): items in Vault are versioned. If you do not specify a version in a get request, the latest version is returned. The AuthN docs call out the concrete case: after rotating a JWT signing key, you need the right version of the public key, and you can request all versions via the version parameter.