The public host resolves through the CoreDNS rewrite to ingress-nginx and the fetch timed out, so the validator answered 403 with a context-deadline error on every caller. Point jwksUrl at zitadel.iam.svc.cluster.local:8080, which the NetworkPolicy already allows.