Good point. I may have even thought of that all those years ago, but I can't remember that far back. I eventually was just appalled that something so basic (and basically flawed) would be so sacrosanct and beyond discussion. Even after demonstrating - "look, if I have this key, I can identify as a different user" - I was essentially dismissed as a crank. At some point you get a label, and regardless of the validity of what you say, you're ignored, and that's a lesson I learned the hard way.

IIRC, doing any sort of validation on the PHP side was deemed to be too computationally expensive (you know, cause it's PHP) but somehow calling a webservice over a network that then connected to a database across a network as well was somehow 'performant'. An HMAC approach on the PHP side could have been done just fine, but I think it would have left the Java guys with less control over the process (which brings up again that this was less technical and more political).