Comment by mixedCase

> Anyway, no, because you need to parse a header to read the JWT, so you inherit all of the problems that stem from that.

Can anyone enlighten me what point is the author trying to make? JWT is pretty damn standard so it's my go-to for signing objects.