Library choice: golang.org/x/oauth2 for the code exchange, github.com/coreos/go-oidc/v3 for the ID token's verification (issuer, audience, expiry, signature from the issuer's JWKS).