In reply to Tara St. Clair.

Thanks, amazing!
To whom who may be interested, for example in python using the python-jose package, signature validation is straightforward:

from jose import jwt
jwt.decode(token,key,audience="{{CLIENT_ID}}")

where "token" is the token obtained from Viya, "key" is the json obtained with the GET request to SASLogon/token_keys, and audience is the intended client_id.

If it works, the token is authentic. If you get an error, the token has been spoofed or is not intended for you!