Comment by fabian2k

Someone not verifying the signature at all is not a mistake where you can blame the JWT spec itself.