Oh, I must have misread? I thought the thing was a custom encryption/decryption dance instead of a signed JWT.