Standard HMAC-based signing (HS256 and similar) is supported for generating a signed token from a header and payload you provide.
No — signing happens entirely in your browser using the Web Crypto API. Your secret key is never sent to a server.
Yes, that's a common use case — just make sure any secret used for testing isn't your real production signing key.