It's not like he is rolling out his own crypto library. He's just rolling his own token but encrypted/signed with industry standard crypto. It's not terrible t

It's not like he is rolling out his own crypto library. He's just rolling his own token but encrypted/signed with industry standard crypto. It's not terrible to "roll your own JWT" if you don't actually care about interoperability. And he's right, it does sidestep a lot of issues because JWT and corresponding libraries are designed to handle far more use-cases than what he may need it for and therefore if you don't fully understand it all, you may be shipping with unsecure configuration.