nodejs-kms | js client for Cloud KMS | GCP library

I am using Google KMS (https://cloud.google.com/kms/) with an asymmetric signing key to sign JSON Web tokens (jwt) in a node.js application.

I am able to create header and payload and with the Google KMS nodejs library (https://github.com/googleapis/nodejs-kms) I can sign the token.

But it seems that the generated token is not valid.

In fact I am doing the following steps to generate a token:

1. define jwt-header as object
2. jwt-header object to string
3. base64url encode jwt-header-string
4. define jwt-payload as object
5. jwt-payload object to string
6. base64url encode jwt-payload-string
7. concatenate (header.payload)
8. decode string to base64 byte array
9. create sha256 hash on byte array
10. select asymmetric key from google kms
11. use asymmetric key to get the signature byte array
12. use base64url encoding on the signature
13. build token (header.payload.signature)

This token alway brings the error (invalid signature). See https://jwt.io/

The public key to verify the token: