First, thank you for providing the module, saved me a lot of time.

According to https://developers.google.com/identity/protocols/OpenIDConnect?hl=en#prompt

The Issuer Identifier for the Issuer of the response. Always https://accounts.google.com or accounts.google.com for Google ID tokens.

Google allows for two possible values. In the verify method the code can only check for one possible value:

if (options.issuer) {
    if (payload.iss !== options.issuer)
      return done(new JsonWebTokenError('jwt issuer invalid. expected: ' + options.issuer));
  }

Is this a problem? or am I missing something.
The fix would be to treat iss similar to aud in the verify method. Should iss be treated similar to aud?

Thanks.