I am using Jose in Node.js to create a JWS signed with a public/private RSA key pair. I am then creating a JWK, which I use to verify that the token is valid. This works well, however I have noticed that if I generate a token with different keys, the JWS is still considered valid.

This is how I generate the JWS and JWK:

export const signJWT = async ({ sub, aud }: JWTParams) => {
    const privateKey = await importPKCS8(JWS_PRIVATE_KEY,'RS256')

    return await new SignJWT({ version: '1.0.0' })
        .setProtectedHeader({ alg:'RS256' })
        .setSubject(sub)
        .setIssuer(ISSUER)
        .setAudience(aud)
        .setIssuedAt()
        .setExpirationTime('24h')
        .sign(privateKey)
}

export const createJWK = async () => {
    const publicKey = await importSPKI(JWS_PUBLIC_KEY,'RS256')

    return await exportJWK(publicKey)
}

The JWK is exposed on a URL. In my application, I attempt to verify the JWS like so:

const JWKS = createRemoteJWKSet(new URL(`${JWKHost}/.well-known/jwks.json`))

await jwtVerify(token ?? '', JWKS)

As expected, I can generate a token and it will pass verification.
If I change the keys, I would expect the old token to not be verified – but it is.

Am I doing something wrong, or have I misunderstood the entire concept?