> Then I can verify all their tokens with the private key. Mmmm. No. You're supposed to use a public key to verify the tokens, not a private key. What library

> Then I can verify all their tokens with the private key. Mmmm. No. You're supposed to use a public key to verify the tokens, not a private key. What library are you using that tolerates this sort of misuse?