SfAuth challenge now uses signatures for validation. Does not encrypt nonce, but expects a signed nonce in return before authenticating.
SfAuth and SfReg no longer json_decode's data. This should be the responsibility of the app implementing framework
EC keys supported for authentication