I think with JWTs, you sometimes need to do this because the JWT itself stores the id of the key used to create the JWT. For example, if you have a multi-tenant application where each tenant has their own key, or for key rotation (although in the key rotation case, I guess you might be able to try every key instead.)