That second hash is called a Message Authentication Code (MAC), it's what the JWT HS256 algorithm does