Hi @conormarkmurphy,
Thanks for opening this post.
I can only try to help here as I have only basic knowledge of JWT. I worked on this post where I post an answer with some details about the basic steps on how to configure JWT.
Maybe this can help you to get closer to solving the CA issue. Also, worth to mention to check this video link which explains about the signature-based certificate with JWT and use httfps://jwt.io/ for live debugging (which I also used).
I hope this helps. and maybe some other community member could provide more details on this post.