It’s also difficult to actually get people on board with the idea of supplying a user-specific signing key instead of relying on a global one. Instead they’ll

It’s also difficult to actually get people on board with the idea of supplying a user-specific signing key instead of relying on a global one. Instead they’ll end up persisted in a data store, making them stateful, because there’s no reliable way to invalidate such a token simply by rotating the signing key. Or using a cookie-backed session.