I just realized, the client can simply omit a cookie value anyway. To prevent this, we should convert/sign the complete set ofkvariables instead of signing them individually.