I'm writing an application to sync some data from a service to salesforce and back. I'm working with a developer account and so far I was able to implement the bulk of the needed functionality merely using OAuth password authentication.
Now I want to begin to use a real, more secure, authentication/authorization scheme. JWT seems to be the best way for a server to talk to salesforce.
My question is:
How to share certificates between the two?
Should I ask the user to create a new app and certificate providing it to me (this defeats the point of having an "app")?
Should I provide the public certificate to the client so he can install it in his keystore? (this would be optimal since there is no secret sharing but still trust between the app and salesforce)