code: protected JwtSignatureValidator createSignatureValidator(SignatureAlgorithm alg, Key key) {
          return new DefaultJwtSignatureValidator(alg, key, base64UrlDecoder);
      }
docs: /*
  @since 0.5 mostly to allow testing overrides