I was able to download and run the .NET WPF/WinForms example (our largest code base is in C# WPF). This failed with an error about HS256. Changing the live production setting (!!!) to RS256 temporarily allowed the sample app to complete authentication without the error.
This proved the sample is working as designed.
I then added another button to test the delegation endpoint. See the handlers for the button here: https://pastebin.com/HEhpMtKn. Note that I also had to modify the client initialization to include Scope = "openid offline_access";. This appears to give me a good result.
HOWEVER, our application is currently targeting the .NET 4 Client Profile. The sample would not run with the nuget package unless it was targeting .NET v4.6.2. That is a significant change that will require testing and a substantial change to our application.