The reason I am not a fan of signed JWTs as a technology is because of their cryptographic agility. There have been too many circumstances where even big player

The reason I am not a fan of signed JWTs as a technology is because of their cryptographic agility. There have been too many circumstances where even big players who should have known better have fallen afoul of alg: none or hmac where they weren’t expecting it. See https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bcp/ https://auth0.com/blog/a-look-at-the-latest-draft-for-jwt-bc... for a quick overview.