These tests are just a first pass, right? We had talked about testing some JWT Producer object directly which would avoid the duplicate assertions with this subclass approach you have here. If that comes in a later patch then cool.