If I wanted to use supertokens on a .net backend, the recommended way would be to issue the jwt and use the jwks to validate as a normal jwt right?

yes! that would be the easiest way.

Yeah, that is what I was thinking. Having a small node api which handles the /auth endpoints

makes sense.