Why would you not like a solid mechanism for verifying that a data packet hasn't been tampered with? In the case of JWTs which live in the browser, it would be essential that they are signed.

dotnet auth tokens are also signed, they are stored in cookies, is that any different?