You shouldn't have your crypto designed by a CEO
In the spirit of nand-gate: "An IETF[1] is angry and shocked that an internet does not want to use their crypto dumpsterfire"<p>Case in point, the mentioned COSE format makes signatures by defining protected and unprotected attributes of the payload and then computing signatures over the Canonical CBOR encoding of the protected attributes. All this is done so that you can have parts inside your payload that can be changed without invaliding the signature, and it of course requires two-phase canonicalization. Yes, PASETO is absolutely, unequivocally a better choice than J/COSE.<p>Sign. The. Goddarn. Bytes.<p>[1] Actually not just any IETF but the dude who made an incompatible fork of msgpack named after himself.