Comment by taybin

Didn’t JWT have a similar thing, where you could specify the algorithm to use and that included “null”?