I have a lot of trouble understanding the issue in the comparison with JOSE. The problem with JOSE's header was that many libraries offered an API that was "val

I have a lot of trouble understanding the issue in the comparison with JOSE. The problem with JOSE's header was that many libraries offered an API that was "validate that this is a valid token using one of these keys", but a key was just one part of the unauthenticated header. An attacker could create a token that used one of the keys with an algorithm it didn't belong to and create a token that was signed by one of the whitelisted keys in a wrong algorithm. The solution was to make sure all the libraries had the API where the user whitelisted allowed values of the entire header: "validate that this is a valid token using one of these headers (alg+key)". I'm not sure what the corresponding version of the first issue would be in age, and then why the answer wouldn't be for age to make sure to check the entire header against a whitelist instead of considering just a subset of it.