> no need to be a crypto expert to sign cookies You literally just said the equivalent of "no need to be a crypto expert to implement cryptographic signatures.

> no need to be a crypto expert to sign cookies You literally just said the equivalent of "no need to be a crypto expert to implement cryptographic signatures." Please don't do that without a crypto expert on staff. They'll be able to avoid side channels that non-experts will never even imagine. To wit: http://blog.ircmaxell.com/2014/11/its-all-about-time.html http://blog.ircmaxell.com/2014/11/its-all-about-time.html It's just a bad idea all around.