That's nice and all but standards exist for a reason. You ask devs to use it in order to be compliant. Regardless of merits, you can't ask people who are not kn

That's nice and all but standards exist for a reason. You ask devs to use it in order to be compliant. Regardless of merits, you can't ask people who are not knowledgable about crypto to use a library by some guy/corp just because you think it has better merits. I mean, I guess you can and some will listen but only a few. Most webdevs for non-web businesses are happy to go with a standard so if something goes wrong they don't get blamed for picking it. And many security/vulnerability pros agree with that line of thinking as well. In practice,if paseto is better I think an internet draft is in order. If JSOE is bad by commonly accepted security measurements then shouldn't the ietf wg have a mailing list where these shortcomings can be discussed and fixed?