> unless you encrypt your token after you generate it Generally it's better to avoid unauthenticated encryption. That is, encrypt-than-sign, not the other way

> unless you encrypt your token after you generate it Generally it's better to avoid unauthenticated encryption. That is, encrypt-than-sign, not the other way around.