As per #2732 and #32847, only the CA thumbprint should be included in the OIDC provider thumbprint list.