How (not) to sign a JSON object (2019)