Set encodedToken = ..UrlEncoding($System.Encryption.Base64Encode(..header.%ToJSON(),1)_
     "."_ $System.Encryption.Base64Encode(..payload.%ToJSON(),1))

     Set tFile=##class(%Stream.FileBinary).%New()
     Set tFile.Filename=secretLocation
    
     Set pemPrviateKey = tFile.Read($$$MaxLocalLength)
    
     Set secretSigned = ##class(%SYSTEM.Encryption).RSASHASign(512,encodedToken,pemPrviateKey)
    
     Set signature = $Translate($System.Encryption.Base64Encode(secretSigned, 1),"+/=","-_")
    
    Return encodedToken_"."_signature

In my scenario the token is two encrypted JSONs appended together and the signature gets appended to the end.

The code above doesn't produce anything at secretSigned, the PEM encoded private key is valid.