It would be nice to add an OAuth2TokenValidator that validates the typ header value. This is simpler than needing to create a jwtProcessorCustomizer and also would simplify adding validators that follow specs that require a certain typ value like RFC 9068.