Certificates from the Local Machine\Computer or User Store can be used to decrypt or sign messages. Administrators have full control over the certificate private keys. When debugging locally through Visual Studio in the process of generating a json-web-token, decrypting, or signing a payload you may get the following when attempting to load the certificate:
Keyset does not exist
Alternatively, you can give your account access to the private keys by right clicking on your certificate -> All Tasks -> Manage Private Keys...
Add your own account and give it Read permissions.
Can be automated through Powershell.
Also interesting to note that the certificate thumbprint copied from the MMC/UI can contain an extra space or hidden character:
support.microsoft.com/en-us/topic/certifica.. (so many typos...).