Tokens can be either signed (using JWS [0]) or encrypted (JWE [1]), which means that you're just trusting that your encryption/signing key hasn't been leaked.

Tokens can be either signed (using JWS [0]) or encrypted (JWE [1]), which means that you're just trusting that your encryption/signing key hasn't been leaked. [0] https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-31 https://tools.ietf.org/html/draft-ietf-jose-json-web-signatu... [1] http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption http://tools.ietf.org/html/draft-ietf-jose-json-web-encrypti...