To avoid storing private keys on a client, it's possible to move signing to Authentication Middleware.
The following API should be implemented in Authentication Middleware:
- RegisterPrivateKey(privateKeyId, privateKey, clientId) which should be called only once manually from the Unity editor script
- CreateClientSecret(privateKeyId, teamId, clientId) which returns signed JWT to be used for PerformCodeExchange, RefreshAccessToken and RevokeAccessToken calls.