verify JWS via JWK instead of PEM