You should be validating all protected headers, in much the same way as border patrol should reject a crayon drawing of a passport. JWS (and JWT) standardized

You should be validating all protected headers, in much the same way as border patrol should reject a crayon drawing of a passport. JWS (and JWT) standardized interoperable parameters and what they mean, but applications are supposed to standardize how they are used. An integrity protected message used as part of a transaction, one used to represent user state, and one used for document archival are going to have dramatically different requirements for verification metadata. Similarly, a signed message issued by a single site vs one meant for use across a federation will have different requirements. This is the #1 misconception of JWS/JWT which has led to people mislabeling it as insecure. They are only using the half that defines what fields mean, and ignoring application-specific instructions on if they are supposed to accept and how they are supposed to process those fields.