Trusted keys now validated and loaded at n8n startup

The token exchange module in n8n can now load trusted public keys at startup. Previously, the TrustedKeyService was a placeholder that returned nothing — JWT verification couldn't work without actual key material. Now administrators can configure trusted keys via the N8N_TOKEN_EXCHANGE_TRUSTED_KEYS environment variable, and those keys are parsed, validated, and stored in-process before the controller starts accepting requests.

The validation layer catches configuration errors early. Duplicate key IDs throw immediately. Algorithm families must be consistent — an RSA key can't claim ES256 support. Key types must match their algorithms — an EC key can't be used with RS256. HMAC symmetric algorithms and the "none" algorithm are rejected entirely, closing a class of security issues. JWKS sources are recognized and logged but skipped for now, signaling that dynamic key fetching is a planned extension.

In the n8n CLI's token-exchange module, startup now blocks if any trusted key fails validation rather than silently misbehaving at runtime. This shift-left approach means deployment pipelines catch configuration drift before users are affected.