client assertion contains invalid signature

In all of these flows initiated by the RP, the end-user interaction from the consumption device is required and, they are based on HTTP redirection mechanisms. OpenID Connect allows Relying Parties (RP) to authenticate their users for clients of all types, including browser-based JavaScript and native mobile apps, to launch sign-in flows and receive verifiable assertions about the identity of signed-in users. OAuth Dynamic Client Registration Metadata Registration OAuth Authorization Server Metadata Registration OpenID Provider Obtains End-User Consent/Authorization Authentication Request Acknowledgment Validation Successful Authentication Request Acknowledgement The user starts the flow with the Relying Party at the Consumption Device, but authenticates and grants consent on the Authentication Device. This specification allows a Relying Party that has an identifier for a user to obtain tokens from the OpenID Provider. This specification has the concept of a Consumption Device (on which the user interacts with the Relying Party) and an Authentication Device (on which the user authenticates with the OpenID Provider and grants consent). However, unlike OpenID Connect, there is direct Relying Party to OpenID Provider communication without redirects through the user's browser. OpenID Connect Client Initiated Backchannel Authentication Flow is an authentication flow like OpenID Connect. Openid-client-initiated-backchannel-authentication-core Abstract OpenID Connect Client-Initiated Backchannel Authentication Flow - Core 1.0 OpenID Connect Client-Initiated Backchannel Authentication Flow - Core 1.0 Final

Client assertion contains invalid signature