Totally agree! Although I'm one of the contributors to that repo as well, the sheer number of possible attack vectors on the JWT scheme means that I was reluctant to use it in a publicly-facing use case. Let me know how it goes!