If you share the hmac key or do private/public key signing you're able to distribute the public signing keys to your infra.

In doing so you just validate the token against the public key. You can then rotate these keys and have a list of them to validate against and age off keys which would be the last tokens expiration +1 day.