title: What does Firebase server side verifyIdToken() do under the hood?
body: <p>I'm considering to use Firebase to perform <a href="https://firebase.google.com/docs/auth/admin/" rel="noreferrer">identity verification</a>. I am new to JWT, so my apologies if this is an obvious question, but I don't understand how the verification is actually done. It seems that <code>FirebaseAuth.getInstance().verifyIdToken(idToken)</code> works asynchronously, as the result is obtained via a listener. I understand that some <a href="https://www.googleapis.com/robot/v1/metadata/x509/securetoken@system.gserviceaccount.com" rel="noreferrer">certificates</a> are used as described <a href="https://stackoverflow.com/questions/37408684/is-it-still-possible-to-do-server-side-verification-of-tokens-in-firebase-3?noredirect=1&amp;lq=1">here</a>, and that those certificates are rotated regularly. Does it mean that networking is required between my back-end server and Firebase server's <em>each</em> time I will call <code>verifyIdToken()</code>? Isn't it a problem ?</p>