I’ve already posted a similar question here, but I’ve realized that my issue could have more to do with x509 certificate rather than JWS in general. Here’s the thing, I’m pretty new to JWS, and Apple now transmits them as part of their server-to-server communication. I’m trying to understand how to fully guarantee the validity of the JWS, because from