I understood this to be the issuer of the token which is the same cert who's decrypting it, hence "self". Then again I'm not 100%, I'll double check.