Except if you use saml, now you have xml digital signatures. If you thought jwts were bad, take a look at the specs for xml digsig sometime. You can specify mul

Except if you use saml, now you have xml digital signatures. If you thought jwts were bad, take a look at the specs for xml digsig sometime. You can specify multiple signed portions of a document, have multiple sigs, or choose to sign only a part, use a bunch of different algorithms, specify your own canonicalization rules, and you get all the usual fun of xml parsing risks. If jwts are bad, xml digsigs are "literally cthulu".