Both the assertion signer and the provider validation derived the algorithm from the key and had to handle a missing "alg" that NewClientConfig already rejects. Validate it once at construction and keep the result.
