What are the potential consequences of ignoring an 'invalid_grant' error?

The public key should be obtained directly from the issuer of the JWT. It's typically provided in a trusted certificate or key store. Verify the certificate's chain of trust to ensure it's issued by a recognized Certificate Authority (CA). Never trust a public key from an untrusted source.