...
            RSACryptoServiceProvider publicOnly = new RSACryptoServiceProvider();
            publicOnly.ImportParameters(rsaParams_Public);
            TokenValidationParameters validationParameters = new TokenValidationParameters()
            {
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new RsaSecurityKey(publicOnly), // проверяется открытым ключем

                ValidateIssuer = true,
                ValidIssuer = _settings.Issuer,

                ValidateAudience = false,

                ValidateLifetime = true,

                ClockSkew = TimeSpan.Zero
    
            };

            JwtSecurityTokenHandler recipientTokenHandler = new JwtSecurityTokenHandler();
            ClaimsPrincipal claimsPrincipal = recipientTokenHandler.ValidateToken(tokens.AccessToken.Value, validationParameters, out var securityToken);