EXTJWT signed with HMAC is impractical for use with arbitrary IRC networks

[vith]

Our use of HMAC signatures on JWT makes it impractical to validate tokens that are signed by IRC networks that aren't part of the same operational group as the fileupload server. The secret is used as a symmetric key in HMAC, so anyone who can validate a token can also forge them.

Supporting and using public/private keypair-based signatures for the tokens (RSA or ECDSA, etc.) would make it possible for a fileuploader server to validate tokens without needing to be trusted with the capacity to create them.

[prawnsalad]

This would be advantageous. Can we get a working concept for this? Perhaps linking this issue to one on webircgateway that implements EXTJWT.