Could not match JWT signature to any of the bindings

I uploaded the public cert for my RSASHA256 key to one of the projects on my organization's project page. The key is new and not expired.

I am pretty confident I formatted the first two parts of the JWT correctly. I am sending a Unix time that is not expired. I signed my header and payload with the private key and tried exchanging it for an access token. I got this back:

{
"error_description": "Could not match JWT signature to any of the bindings",
"error": "invalid_token"
}

What exactly does this mean? What is "bindings" in this context -- my organization's projects? Is the JWT formatted correctly if I've reached this point?

No file, test, or entry point is identified in the issue. Start by reviewing the authentication documentation covering JWTs, public certificates, and bindings, then determine what explanation is missing. Done means the documentation clearly explains the error, the meaning of bindings, and whether this response confirms JWT formatting.

Written by the indexing model from the issue text.