(untitled)

Oh, I just realized quantum computers (and the massive size of ML-DSA signatures) will probably kill asymmetrycally-signed JWTs as bearer tokens. This is good. 90% of the time, asymmetric signatures are unnecessary complexity, and a session ID or a HMAC would do just as well. Also, crypto libraries consider signatures public, while ~all signed bearer token schemes abuse them as the only secret…