You say that they reject alg: none, but even auth0 got caught by alg: nOnE… One of the main issues I have with JWT is that it has a fairly high degree of crypt

You say that they reject alg: none, but even auth0 got caught by alg: nOnE… One of the main issues I have with JWT is that it has a fairly high degree of cryptographic agility rather than a version number that specifies a set of cryptographic primitives.