Generate an ECDSA key pair in your browser with the WebCrypto API. Elliptic curve keys are a fraction of the size of an RSA key at the same strength, which is why ES256 is the usual choice for a JWT. You get both the PEM pair (SPKI public, PKCS#8 private) and the JWK pair. Nothing leaves your browser.