Lengthen the demo signing keys in the identity-assertion examples

The identity-assertion tutorial and its example story signed their demo
ID-JAG tokens with HMAC keys of 30 and 20 bytes. PyJWT 2.11+ warns
when an HS256 key is shorter than the 32-byte minimum from RFC 7518,
and pyjwt is uncapped, so a fresh install already emitted that warning
from the shipped example. The demo keys are now at least 32 bytes.

No-Verification-Needed: docs-example demo constants; behavior driven directly

Author: maxisbey

docs_src/identity_assertion/tutorial001.py

@@ -9,7 +9,7 @@
 from mcp.client.streamable_http import streamable_http_client
 from mcp.shared.auth import OAuthClientInformationFull, OAuthToken
 
-IDP_SIGNING_KEY = "the-enterprise-idp-signing-key"
+IDP_SIGNING_KEY = "the-enterprise-idp-signing-key-for-this-demo"
 
 
 class InMemoryTokenStorage:

docs_src/identity_assertion/tutorial002.py

@@ -21,7 +21,7 @@
 ISSUER = "https://auth.example.com/"
 MCP_SERVER = "http://localhost:8001/mcp"
 IDP_ISSUER = "https://idp.example.com"
-IDP_SIGNING_KEY = "the-enterprise-idp-signing-key"
+IDP_SIGNING_KEY = "the-enterprise-idp-signing-key-for-this-demo"
 
 REGISTERED_CLIENTS = {
     "finance-agent": OAuthClientInformationFull(

examples/stories/identity_assertion/idp.py

@@ -14,7 +14,7 @@
 IDP_ISSUER = "https://idp.example.com"
 # Demo only: a real IdP signs with its private key and the authorization server verifies the
 # signature against the IdP's published JWKS. A shared HMAC secret keeps this story self-contained.
-IDP_SIGNING_KEY = "demo-idp-signing-key"
+IDP_SIGNING_KEY = "the-demo-idp-signing-key-for-this-story"
 
 
 def issue_id_jag(*, subject: str, client_id: str, audience: str, resource: str, scope: str) -> str: