This partner login verifies RS256 against a public key it publishes at /.well-known/jwks.json and /keys/public.pem. Present an SSO token as ?sso=<jwt>. A sample RS256 token (role:user) is below — inspect its header, then ask what happens if you hand the verifier an HS256 token whose HMAC key is that public key. Get role:admin in that way.
eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InJhdGF1dGgtcnMyNTYtMjAyNiJ9.eyJzdWIiOiJkZW1vIiwidWlkIjoyLCJyb2xlIjoidXNlciIsImV4cCI6MTc5MjU0NzUwNX0.Sqk7EnmttSy3oCEKrDTbqlUcKCLcDyYC7apeLiU-KLwZmNeYRvRvananUCk69Gchdbolj7aGNswsXzSKhIDbg0WDOnq9UlayAjEsQlepVolIjfTIrM-1wK7mmu65IJzT5dNoH0FRO-Cob3SbhxtLRqTfqg2tbng6csrzOT4j4oKua-DwtP1TqnO-_NrUwSn8v1Bg2p4id-dO1EjJerm8sbmMIHe0nj2kcvCsuKiaaf6cjSnoBZPjwm2a3Z172OgsZ6I0jO2PB9sCIHlFOp-Y26a51N9jmfLdA12K2d6MTzLLR5eKH-M8CYHTG37qsyKkBu7SyOEaruCiQsSXt3WE8w