Preverification API

`sign_compact` doesn't return JSON, it returns a JWT string. I should give it an `application/jwt` content type though, you're right.