How does JWT validation work in Apigee?

<!-- VerifyJWT: validate a JWT from the Authorization header -->
<JWT name="JWT.Verify">
  <Operation>VerifyJWT</Operation>
  <Source>request.header.authorization</Source>
  <IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
  <!-- Validate signature using a public key stored in KVM -->
  <PublicKey>
    <JWKS ref="kvm.jwks.endpoint"/>
    <!-- Or use a static PEM:
    <Value ref="kvm.jwt.public-key"/> -->
  </PublicKey>
  <!-- Optional claims validation -->
  <Issuer>https://auth.example.com</Issuer>
  <Audience>https://api.example.com</Audience>
  <!-- AdditionalClaims can validate custom claims -->
  <AdditionalClaims>
    <Claim name="role" type="string">admin</Claim>
  </AdditionalClaims>
</JWT>

<!-- After successful VerifyJWT, claims are available as flow variables:
  jwt.JWT.Verify.claim.sub         -- subject
  jwt.JWT.Verify.claim.email
  jwt.JWT.Verify.claim.role
  jwt.JWT.Verify.claim.exp         -- expiry epoch
  jwt.JWT.Verify.valid             -- true/false
-->

<!-- GenerateJWT: create a JWT for backend (service account flow) -->
<JWT name="JWT.Generate">
  <Operation>GenerateJWT</Operation>
  <ExpiresIn>3600</ExpiresIn>
  <Subject>apigee-proxy</Subject>
  <Issuer>https://api.example.com</Issuer>
  <SecretKey>
    <Value ref="kvm.jwt.signing-secret"/>
  </SecretKey>
</JWT>