Looking at the validation section of https://learn.microsoft.com/en-us/azure/active-directory/dev... - did I miss something or does that still lack any mention of the importance of checking dates or revocation for the issuer? Since the pseudo code doesn’t I’d bet there are more implementations which trust any key Microsoft has ever published (modulo some kind of cache purge).