code: private static boolean verifySignature(String content, String signed, RSAPublicKey pk) throws InvalidTokenException {
          try {
              byte[] signedData = Base64.urlDecode(signed);
              byte[] contentData = content.getBytes(JWT.UTF_8);
  
              Signature signature = Signature.getInstance(ALG_SHA256WITHRSA);
              signature.initVerify(pk);
              signature.update(contentData);
  
              return signature.verify(signedData);
          }catch (SignatureException e) {
              throw new InvalidTokenException("Invalid signature", e);
          }catch (Exception e) {
              throw new RuntimeException("Verify signature error", e);
          }
      }
docs: 基于RS256算法验证
  @throws InvalidTokenException 如果签名的格式不正确