Improper handling of the base64-encoded signing key

[uint]

Description

Hybrid Connections generate signing keys that are base64 encoded, but then expect the client to grab that base64-encoded string, take the underlying bytes and sign the token with that.

Here's an example of a client that probably works, but is wrong: https://github.com/Azure/azure-relay-dotnet/blob/dev/src/Microsoft.Azure.Relay/Common/TokenProvider.cs#L16

A client that is implemented correctly and first decodes the base64-encoded key fails to authenticate.

I'm no cryptographer, but could this have some impact on the strength of your security?

Here's Azure documentation stating that the keys are base64-encoded: https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-sas#overview-of-sas

Actual Behavior

1. Send an HTTP request to a Hybrid Connection thingy, passing a token signed with a properly decoded base64 key.
2. Azure responds with an Invalid Signature error.
3. Send an HTTP request to a Hybrid Connection thingy, passing a token signed with the bytes of the base64-encoded string.
4. Authentication succeeds.

Expected Behavior

The reverse of the actual behavior.