I am interested in this too, because I think it is a waste of bandwidth and computing power to retrieve these public keys online whenever we need them. But if it really changes periodally as 'souldchild' said, then it can't be helped. [We have to access it online every time.] I am adding this comment because his idea of using cron job is a bad idea. Even if, let's say, this cron job is reduced to once every an hour. What if our user tries to "apple sign in" during the time that apple changes the public keys, just several minutes after our last cron job runs?

Do not use this privaterelay.appleid.com service! From my own experience, this service can't forward almost all kind of email. From what I read on the developer forum, apparently it gets suspicious of emails easily and it will only forward emails from people who built their own mail server. Companies who used third party service to sent their emails won't have their emails sent! I have tested it myself. My app send emails through google's smtp service and none of my email is sent. Is gmail not trustworthy to you, apple?