> IMO one of the major problems with JOSE is that the algorithm to be used for verification is part of the object being verified and is generally not part of th

> IMO one of the major problems with JOSE is that the algorithm to be used for verification is part of the object being verified and is generally not part of the verification API or the verification key. This results in the alg "none" attack and no shortage of potential downgrade attacks. Right, and I believe this is one of the major misconceptions about JOSE - it isn't defining a data format for secure messages, but common tooling/patterns to be profiled for applications needing secure messaging. This leads to a confusion of responsibilities between a JOSE library and the application using it. So we are watching / participating in efforts like https://www.ietf.org/archive/id/draft-tschofenig-jose-cose-guidance-00.html https://www.ietf.org/archive/id/draft-tschofenig-jose-cose-g... and https://www.ietf.org/archive/id/draft-ietf-httpbis-message-signatures-19.html https://www.ietf.org/archive/id/draft-ietf-httpbis-message-s... . I'm hoping there is stricter guidance across the board by the time JWP goes to publication.