由于我手头没有苹果提供的私钥，我尝试使用以下命令自己生成一个：

openssl ecparam -name prime256v1 -genkey -noout -out key.p8

下面的代码可以使用这样的PEM文件来签署一个令牌：

// load PEM as String from "key.p8" resource
String p8key;
ClassLoader cl = Thread.currentThread().getContextClassLoader();
try (InputStream is = cl.getResourceAsStream("key2.p8");
     InputStreamReader isr = new InputStreamReader(is, StandardCharsets.UTF_8);
     BufferedReader r = new BufferedReader(isr)) {
   p8key = r.lines().collect(Collectors.joining("\n"));
}

// Load ECKey from the PEM
ECKey ecJWK = (ECKey) ECKey.parseFromPEMEncodedObjects(p8key);

// Create the EC signer
JWSSigner signer = new ECDSASigner(ecJWK);

// Create the JWS object with a payload
JWSObject jwsObject = new JWSObject(
        new JWSHeader.Builder(JWSAlgorithm.ES256).keyID(ecJWK.getKeyID()).build(),
        new Payload("Elliptic cure"));

// Compute the EC signature
jwsObject.sign(signer);

// Serialize the JWS to compact form
String jwtToken = jwsObject.serialize();

// print the generated token
System.out.println(jwtToken);

显然，苹果提供的PKCS#8文件中没有包含公钥。因此，上述创建ECDSASigner的方法失败，并出现"Missing PEM-encoded public key to construct JWK"异常。下面的代码从此类PEM文件中加载私钥，并创建可用于签署令牌的ECDSASigner示例。

JWSSigner signer = new ECDSASigner(loadECPrivateKey("key.p8"));

private static final Provider BC = new BouncyCastleProvider();

private ECPrivateKey loadECPrivateKey(String resource) throws Exception {
  ClassLoader cl = Thread.currentThread().getContextClassLoader();
  try (InputStream is = cl.getResourceAsStream(resource);
       InputStreamReader isr = new InputStreamReader(is, StandardCharsets.UTF_8);
       BufferedReader r = new BufferedReader(isr)) {

    // strip header and footer, decode from base64, then load the key
    String text = r.lines()
        .filter(s -> s.length() > 0 && !s.startsWith("---"))
        .collect(Collectors.joining());
    byte[] bytes = Base64.getDecoder().decode(text);

    PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(bytes);
    KeyFactory factory = KeyFactory.getInstance("EC", BC);
    return (ECPrivateKey)factory.generatePrivate(spec);
  }
}