ID tokens had an issue where the fromtimestamp API was used instead of utcfromtimestamp. Ref: #1323.

It appears that impersonated_credentials.py uses the same API, and is likely impacted by the same issue.

➜ rg "\.fromtimestamp" -g '!*test*'
google/auth/compute_engine/credentials.py
392:        return id_token, datetime.datetime.fromtimestamp(payload["exp"])

google/auth/impersonated_credentials.py
457:        self.expiry = datetime.fromtimestamp(jwt.decode(id_token, verify=False)["exp"])

google/auth/impersonated_credentials.py should be updated to use utcfromtimestamp instead of fromtimestamp.