Gotcha, thanks! That makes more sense now. I agree that they're worth examining separately, but the more general point still stands that there is a lot more th

Gotcha, thanks! That makes more sense now. I agree that they're worth examining separately, but the more general point still stands that there is a lot more that can go wrong with sign than with aead. The arguments for broken RSA-encrypted cookies apply similarly to broken signed cookies. It's not clear to me for example that an invalid curve attack against seal is intrinsically worse than a nonce (ab|re)use bug against ECDSA.