How not to sign a JSON object - https://news.ycombinator.com/item?id=20516489 - July 2019 (151 comments)