My guess is that this uses public key cryptography. Generating a signature is rather expensive. We found this out the hard way a few years ago, when we tried to

My guess is that this uses public key cryptography. Generating a signature is rather expensive. We found this out the hard way a few years ago, when we tried to verify OAuth tokens using RSA rather than HMAC. The server was hammered at maybe 500 signatures a second, greatly slowing down token generation. I'm guessing they dropped to Rust so they could use native C libraries for signature generation.