The idea is great and the instructions clear and easy to follow for a quick integration. (the localhostmagicsquared.net workaround is a brilliant idea) But I

The idea is great and the instructions clear and easy to follow for a quick integration. (the localhostmagicsquared.net workaround is a brilliant idea) But I see you are using RS256 and that makes me think of a security issue. Since you are the only one having the private part of the key pair, you could (in the future) log in as any user on any website that uses magicsquared.net since you can generate properly signed JWTs with any possible content. I understand that this allows for less friction (and thus, more magic) but I think it is a serious problem in case of a breach or malicious intent. Does anyone know of a way to solve this in a more secure way without adding too much friction?