Since we're leaving this up to individual apps/implementors how to interpret this, maybe we should make it an arbitrary JSON type? (eg allow an Object). That way if people want to indicate the algorithm, parameters, etc, they can. We'd still only use it as a string by default, though.