We are using OAthkeeper to verify JWT tokens, using the JWT authenticator. If I provide a random string as bearer token, I would expect to get a 403 response from Oathkeeper, but I receive a 500 error. Similarly if I provide a token for which my JWKS does not have a matching kid, I get an internal server error (raised from here: https://github.com/ory/oathkeeper/blob/f6adf0be4e8e1f44c4d05e8ebdac03bcef5d0f6a/credentials/fetcher_default.go#L148). Is this done on purpose, is there a way to return the more descriptive 403 error if a user fails to provide a proper key?