I currently use decode to get the kid, then use verify with the correct key. This could be simplified if verify would accept secretOrPrivateKey to be a function(kid) so this could be handled in one step.

I could make a PR in the coming weeks, would this be accepted?

EDIT: I just realize that function(kid) would probably fetch the key asynchronously from the AP. In that case the function would return a promise. That can only work if verify is called asynchronously. I think it's possible to implement this backwards compatible. Perhaps in the future the whole library should be made with promises instead of callbacks? Any thoughts?