the payload of jsonWebSignature contains:
"iss": the issuer of the certificate, as an element reference (index:identifier pair) or identifier
"sub": the subject of the certificate, as an element reference (index:identifier pair) or identifier
"exp", "nbf", "iat": expiration, not-before, and issued-at dates as numeric seconds since the epoch
"publicKey": the public key of the subject, in JWK format (RFC 7517) [6]
"perms": a list of permission objects, where each permission object has the form { "handle": "identifier",
"perm": "permission" }
with "permission" one of "everything", "thisHandle", "derivedPrefixes", or "handlesUnderThisPrefix"
"chain": an optional list of element references (index:identifier pairs) or identifiers, used to build a chain
of trust for validating the certificate issuer (in the absence of an explicit chain, the chain can still be built
implicitly, as will be discussed)