Just ran in this problem, when trying to log in as a test user. Any fixes yet that don't involve downgrading XCode?

Hi, so the JWS contains a chain of certificates (x509) in its x5c header. The first certificate contains the public key used to verify the signature of the JWS. What we need is a way to verify that the certificates are also trustworthy (i.e. signed by Apple and/or a trusted CA). You can find these certificates on their site https://www.apple.com/certificateauthority/. All you need to do now is download them and, whenever you receive a JWS, validate them against the ones found in the x5c header. The site has both the intermediate and the root certificates. Good luck!