Tim McLean discovered that pyjwt, a Python implementation of JSON Web
Token, would try to verify an HMAC signature using an RSA or ECDSA public
key as secret. This could allow remote attackers to trick applications
expecting tokens signed with asymmetric keys, into accepting arbitrary
tokens. For more information see: https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/.