> I really hope you're planning some agility in PASETO otherwise it's de-facto s* protocol that will have to be thrown away within a few years upon the first cr

> I really hope you're planning some agility in PASETO otherwise it's de-facto s* protocol that will have to be thrown away within a few years upon the first cryptographic weakness, breaking all applications that dared to adopt it. Instead of cipher agility, PASETO uses versioned protocols. My DEFCON Crypto & Privacy Village talk (slides and YouTube video at https://paseto.io https://paseto.io for the curious) covered this distinction in detail.