presto-main/src/main/java/io/prestosql/server/security/JsonWebTokenAuthenticator.java/DynamicKeyLoader/getKeyId
class DynamicKeyLoader:        private static String getKeyId(JwsHeader<?> header)
        {
            String keyId = header.getKeyId();
            if (keyId == null) {
                // allow for migration from system not using kid
                return DEFAULT_KEY;
            }
            keyId = INVALID_KID_CHARS.replaceFrom(keyId, '_');
            return keyId;
        }