Ok from what I understand, ValidIssuer = "self" is equivalent to ValidIssuer = "CN=AegisAuthSigning" which works here because the certificate issuing tokens and decrypting them is the same.