Asymmetric signed token generator

The same JWT as the symmetric generator builds, signed with RS256 instead of HS256. Everything up to the signing input is identical. What changes is the key: this page signs with a private key, and the signature can then be verified with the matching public key, by anyone, without them ever seeing the private one.

alg is RS256 now: RSA with SHA-256. It tells whoever receives this token that a public key, not a shared secret, is what verifies it.
The same claims the symmetric generator uses, with one exception: iss is this application's own address, because this token really is minted here rather than by the OpenID Provider.