RFC 7515 §4.1.6 specifies standard base64 with padding for each certificate, unlike every other JOSE value, which trips up parsers. Related members are x5t (SHA-1 certificate thumbprint) and x5t#S256 (SHA-256), plus x5u, a URL from which to fetch the chain.
A chain in the token header proves nothing by itself: anyone can attach a self-signed certificate. The verifier must validate the chain to a trust anchor it chose, check the certificate's identity and usage, and only then use the key. Systems that verify against the embedded certificate without path validation have been forgeable. Legitimate uses include Apple and Google device attestation payloads and European eIDAS-related signatures, where verification against trusted lists is part of the protocol.