我想通了。NimbusJwtClientAuthenticationParametersConverter根本不起作用。x5c和kid的声明只是被忽略了，所以我最终用了自己的转换器。而且它是如此的小巧和简单，所以我将在这里分享它。
但首先--我之前的代码中有一个错误，所以转换器从来没有被调用过。下面是你必须在安全配置中添加的内容：http.oauth2Login() .tokenEndpoint().accessTokenResponseClient(accessTokenResponseClient());
我的简单转换器只处理一个签名的JWT，不处理其他任何东西：

public class SignedJwtClientAuthenticationParametersConverter<T extends AbstractOAuth2AuthorizationGrantRequest>
        implements Converter<T, MultiValueMap<String, String>> {

    private static final String CLIENT_ASSERTION_TYPE_VALUE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";

    private final Function<ClientRegistration, String> jwt;

    public SignedJwtClientAuthenticationParametersConverter(
            final Function<ClientRegistration, String> jwt) {
        this.jwt = jwt;
    }

    @Override
    public MultiValueMap<String, String> convert(final T authorizationGrantRequest) {
        ClientRegistration clientRegistration = authorizationGrantRequest.getClientRegistration();

        String jwt = this.jwt.apply(clientRegistration);

        MultiValueMap<String, String> parameters = new LinkedMultiValueMap<>();
        parameters.set(OAuth2ParameterNames.CLIENT_ASSERTION_TYPE, CLIENT_ASSERTION_TYPE_VALUE);
        parameters.set(OAuth2ParameterNames.CLIENT_ASSERTION, jwt);

        return parameters;
    }
}

下面是accessTokenResponseClient bean：

@Bean
public OAuth2AccessTokenResponseClient<OAuth2AuthorizationCodeGrantRequest> accessTokenResponseClient() {
        OAuth2AuthorizationCodeGrantRequestEntityConverter requestEntityConverter = new OAuth2AuthorizationCodeGrantRequestEntityConverter();

        requestEntityConverter.addParametersConverter(
                new SignedJwtClientAuthenticationParametersConverter<>(jwkResolver));

        DefaultAuthorizationCodeTokenResponseClient accessTokenResponseClient = new DefaultAuthorizationCodeTokenResponseClient();
        accessTokenResponseClient.setRequestEntityConverter(requestEntityConverter);
        return accessTokenResponseClient;
    }

    private Function<ClientRegistration, String> jwkResolver = (clientRegistration) -> {
        if (clientRegistration.getClientAuthenticationMethod().equals(ClientAuthenticationMethod.PRIVATE_KEY_JWT)) {
            try {
                return getJwtByClientRegistration(clientRegistration);
            } catch (Exception e) {
                logger.error("Failed to sign JWT: " + e.getMessage(), e);
            }
        }
        return null;
    };

现在显示的是方法getJwtByClientRegistration()，但这里我使用的是JOSE库，我更熟悉它。