Not so sure - you can design things unopinionated but still have them secure. As an analogy, the whole point of statical typing is to allow all sensible program

Not so sure - you can design things unopinionated but still have them secure. As an analogy, the whole point of statical typing is to allow all sensible programs to be written while keeping out everything that contradict itself. I.e if the PASETO were a type and an implementation a program then you wouldn't be able to write an implementation that would adher the type but would be insecure. Doesn't appear to be so with JWT and co.