Vulnerability / Unexpected Token Verification Behavior with Private Key

首先，使用 Node.js 的 crypto 模块以及 JWT 的 sign 和 verify 入口点，根据 issue 中描述的 RS256 步骤复现报告的行为。检查针对 8.5.1 和 9.0.1 版本所记录的密钥处理预期；当行为得到解释，并且预期结果或所需更改得到明确确立时，即表示完成。

Issue Title: Unexpected Token Verification Behavior with Private Key

Description:
I've encountered unexpected behavior while using the jsonwebtoken library for token verification. As per best practices, I'm aware that token verification should use the public key, but I noticed that token verification is succeeding even when using the private key.

Steps to Reproduce:

Generate an RSA key pair using the crypto module.
Sign a JWT using the private key with the RS256 algorithm.
Attempt to verify the JWT using the private key instead of the public key.
Expected Behavior:
Token verification using the private key should fail, as the private key is meant for signing, not verification.

Actual Behavior:
Token verification using the private key surprisingly succeeds, which contradicts the expected behavior.

Environment:

Node.js version: v16.19.0
jsonwebtoken library version: 9.0.1/8.5.1 -> In these versions I have checked.
Operating System: Windows 10

Additional Information:
I've verified this behavior in multiple environments to ensure accuracy. It's important to clarify that this behavior goes against established best practices for token verification. I would appreciate assistance in understanding if this is an issue or if there's a valid explanation for this behavior.