docs: state the real key types accepted on PHP 8

src/JWT.php

@@ -48,7 +48,7 @@ class JWT
         'RS512' => \OPENSSL_ALGO_SHA512,
     ];
 
-    /** @var string|resource The signature key. */
+    /** @var string|resource|\OpenSSLAsymmetricKey|\OpenSSLCertificate|\OpenSSLCertificateSigningRequest The signature key. */
     protected $key;
 
     /** @var array The list of supported keys with id. */
@@ -72,12 +72,16 @@ class JWT
     /**
      * Constructor.
      *
-     * @param string|resource $key    The signature key. For RS* it should be file path or resource of private key.
-     * @param string          $algo   The algorithm to sign/verify the token.
-     * @param int             $maxAge The TTL of token to be used to determine expiry if `iat` claim is present.
-     *                                This is also used to provide default `exp` claim in case it is missing.
-     * @param int             $leeway Leeway for clock skew. Shouldnot be more than 2 minutes (120s).
-     * @param string          $pass   The passphrase (only for RS* algos).
+     * @param string|resource|\OpenSSLAsymmetricKey $key    The signature key. For HS* it is the shared secret string.
+     *                                                      For RS* it should be the parsed private key
+     *                                                      (\OpenSSLAsymmetricKey on PHP 8+, resource on PHP 7) or a
+     *                                                      file path to it. A string is always treated as a file
+     *                                                      path, never as PEM content.
+     * @param string                                $algo   The algorithm to sign/verify the token.
+     * @param int                                   $maxAge The TTL of token to be used to determine expiry if `iat` claim is present.
+     *                                                      This is also used to provide default `exp` claim in case it is missing.
+     * @param int                                   $leeway Leeway for clock skew. Shouldnot be more than 2 minutes (120s).
+     * @param string                                $pass   The passphrase (only for RS* algos).
      */
     public function __construct(
         $key,

src/ValidatesJWT.php

@@ -102,7 +102,8 @@ protected function validateTimestamps(array $payload)
     }
 
     /**
-     * Throw up if key is not resource or file path to private key.
+     * Throw up if key is not a private key instance (resource on PHP 7, \OpenSSLAsymmetricKey
+     * etc on PHP 8+) or a file path to one. A string is treated as a file path, never as PEM content.
      */
     protected function validateKey()
     {