FYI This was recently implemented to support extracting roles from nested claims with Handle roles in nested claim for JWT auth backends by cwperks · Pull Request #5355 · opensearch-project/security · GitHub
A similar approach can be taken to abstract subject_key to extract from nested claims.