Okta has a single signing key with no ability to set per-provider keys, only Azure AD does the right thing out of the box per the article.