I think that makes sense.

Also just more of a background on why signing is preferred for these tokens, is that you can read the contents of the token without needing to decrypt (verify) first that way if they're using the user_id/client_id or whatever else they may have shoved into the claims to use a client or user specific key internally to verify.

I'll get this renamed, I like that suggestion.