I cannot really answer this, as I am not familiar at all with JWT/HMAC...