jsonwebtoken is unmaintained and does not work correctly in the
browser at 9.x. Following the JWT Sign migration (#2473), switch the
remaining two JWT operations to jose and remove the jsonwebtoken
dependency. Unsigned (alg:none) tokens are now rejected by Verify,
and PKCS#1 RSA public keys are converted to SPKI for WebCrypto.