I figured this out in case anyone else runs into this. I had used NetSuite's own sample documentation to built my Oauth2 implementation. It looks like a notification went out last year that the RS256 algorithm was being deprecated on March 1st 2025. But because we were not using Oauth2 at that time, they never sent that notification to us. When I look at the documentation today, the RS256 option is not there. Would have been nice if NetSuite had done another round of notifications.