The following worked:
mp.jwt.verify.publickey.location=https://www.gstatic.com/iap/verify/public_key-jwk
mp.jwt.verify.publickey.algorithm=ES256
mp.jwt.verify.issuer=https://cloud.google.com/iap
mp.jwt.verify.audiences=/projects/xxxxx/global/backendServices/xxxxxx
mp.jwt.token.header=x-goog-iap-jwt-assertion
Notice algorithm=ES256