which means a private key is used to sign the token, and a public key is used to verify the token