I would highly recommend building in key rotation and a well-known endpoint for retrieving public keys. In the Node.js documentation (https://userfront.com/examples/nodejs.html), the expectation seems to be that a single public key is hard-coded into all customer applications. If UserFront's private key is compromised for whatever reason, it should be trivial to rotate keys without requiring all customers to update their application with the new public key.