Signature verification

> Please provide us with the following information:
> ---------------------------------------------------------------

### This issue is for a: (mark with an `x`)
```
- [ ] bug report -> please search issues before submitting
- [ ] feature request
- [x] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)
```

### Minimal steps to reproduce
>

### Any log messages given by the failure
>

### Expected/desired behavior
>

### OS and Version?
> Windows 7, 8 or 10. Linux (which distribution). macOS (Yosemite? El Capitan? Sierra?)

### Versions
>

### Mention any other details that might be useful
Hello,

Thanks to your work, I was able to successfully verify an attestation generated by an Azure CVM.

However, I am struggling to understand how your code verifies the signature of a JWT. I want to ensure that the JWT generated is authentic, has not been tampered with, and was issued by Azure Attestation. Although I have reviewed your code, I am still unclear on the specific steps you are following. Could you please provide some clarity on this matter? How can i reproduce the steps without using the code. Any help you can offer would be greatly appreciated.

Thank you,

> ---------------------------------------------------------------
> Thanks! We'll be in touch soon.

No file, test, or entry point is named in the issue. Start by locating the code that verifies Azure Attestation JWT signatures, then document how authenticity, tamper detection, and issuer validation work and provide a reproduction path that does not depend on the code.

Written by the indexing model from the issue text.