Why does jwt.verify() give "invalid signature"?

You might find helpful information in the solution on this thread: