I'm not familiar with JWT at all, but I found a description of how to generate an ES256 JWT from the command line: https://techdocs.akamai.com/iot-token-access-control/docs/ge... .
I don't know if this would meet your needs, but from Tcl you could use `exec` to run these commands and read the result.