jsonwebtoken is unmaintained and does not work correctly in the browser at 9.x. Following the JWT Sign migration (#2473), switch the remaining two JWT operations to jose and remove the jsonwebtoken dependency. Unsigned (alg:none) tokens are now rejected by Verify, and PKCS#1 RSA public keys are converted to SPKI for WebCrypto.