I don't think this problem is solvable. The server must be able to generate signed JWTs, so if you have access to the server, you'll be able to do that. The cry

I don't think this problem is solvable. The server must be able to generate signed JWTs, so if you have access to the server, you'll be able to do that. The cryptographic details don't matter.