code: function generateRsJws(protect, bits, key) {
    if (key instanceof Buffer) {
      key = key.toString();
    } else if (typeof key !== 'string') {
      throw new TypeError('Key must be a buffer or a UTF-8 string');
    }
    if (!key.includes('-----BEGIN') || !key.includes('KEY-----')) {
      throw new TypeError('Key must be a PEM formatted RSA private key');
    }
    let signer = crypto.createSign(`SHA${bits}`);
    let signature = buf2b64url(signer.update(protect).sign(key));
    return `${protect}.${signature}`;
  }
docs: ===== RS256, RS384, RS512 ==================================================