Apple have published docs on this topic now and also modified the API so that now your JWT subject has to be sub and not subject as I was able to get away with in my first code example.
Topic:
App & System Services
SubTopic:
General
Tags: