Add `iat` and `exp` claims. Also `sub` key.

`sub` key is the fingerprint of the public key of the pair that signed the JWT.