If using a different algorithm to the default (HS256) it must be set manually before calling verify, otherwise will get an "Unexpected signature algorithm" due to the check here https://github.com/jwtk/njwt/blob/master/index.js#L361
The example here should probably call this behaviour out https://github.com/jwtk/njwt#using-a-key-resolver
This tripped me up for a while when verifying a AWS Cognito token