Tweak language

docs/Behaviour - Resource Servers.md

@@ -22,6 +22,7 @@ Resource Servers SHOULD attempt to verify tokens against all keys presented at t
 endpoint. All valid JWK's SHOULD be tried until the token is verified or until no keys are left.
 
 Where a Resource Server has no matching public key for a given token, it SHOULD attempt to obtain the missing public key
+from the Authorization Server's "jwks_uri" property, which can be discovered at the server metadata endpoint
 via the the token `iss` claim as specified in [RFC 8414][RFC-8414] section 3. In cases where the Resource Server needs
 to fetch a public key from a remote Authorization Server it MAY temporarily respond with an HTTP 503 code in order to
 avoid blocking the incoming authorized request. When a HTTP 503 code is used, the Resource Server SHOULD include an