After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, the actual sender (not a man-in-the-middle with access to the public key).
With PGP, public keys are exchanged, and the message is validated against the digital signature. Is it possible to do the same with the JWS and JWE specs? I had a feeling this would somehow be done in the ADD, but doesn't appear to be the case as this is computing the AAD for the purpose of the Auth Tag. Obviously the Public Keys would have to be exchanged for this to work.