Edge compute JWT validation

Design an edge-compute platform feature: run customer JWT validation and A/B-bucketing logic at 300 POPs so requests get authenticated and routed without a round trip to a central region. Constraints: bucketing must be deterministic per user globally, JWT revocation must take effect within ~30s, and you can't ship secrets to untrusted POPs in plaintext. Explain where state and secrets live and how you keep edge logic consistent worldwide.