Ok I'm a bit of a cryptography noob, but are you saying it's possible to alter the encrypted token such that when decrypted by the private key the permissions a

Ok I'm a bit of a cryptography noob, but are you saying it's possible to alter the encrypted token such that when decrypted by the private key the permissions are changed, in this example, but the real GitHub token is not? Edit: nevermind, I think I've just misunderstood the process outlined in the article. I confused the tokens.