In addition to versioning, we're starting with a very limited set of functionality tuned to security not flexibility. If you're using v2, you're either signing

In addition to versioning, we're starting with a very limited set of functionality tuned to security not flexibility. If you're using v2, you're either signing with Ed25519 or encrypting with XChaCha20-Poly1305. There are no additional knobs or levers. Only boring cryptography. A versioned JOSE that limited flexibility is dead in the water. JOSE users will bikeshed over backeards compatibility until the end of time. Might as well specify a new standard at that point. Hence PASETO.