Standard HMAC-based signing (HS256 and similar) is supported for generating a signed token from a header and payload you provide.
No — signing happens locally in your browser; the secret key never leaves your device.
Yes, that's a common use case — just make sure any secret used for testing isn't your real production signing key.