Erik

> Looking at the latest [Yubikit](https://github.com/Yubico/yubikit-ios), they do have a PC/SC interface to the key over NFC. Perahps we could 'hook this up' to the GPG library that pass uses...

This branch contains the commits from #69

Also, I think we should add support for the `sid` claim in the `IdToken` too (even tho this would be already possible with the additional claims support). The backchannel spec...

> That's worth considering. Feel free to file a separate issue for tracking that. I think it'll be a breaking change though since some users may be relying on additional_claims...

@ramosbugs would you mind linking #70 (or the corresponding branch) to this issue?

@isislovecruft care to give this PR some attention or otherwise update the dependencies? Especially the old `digest` and `sha2` versions are a bad, because they block trait bounds.

I'd like to add that the spec currently defines that the graphql query itself as well as the mapping for the files are json encoded. Since the GraphQL spec does...

Also why not expand the spec for responses? There are probably some cases where a external cdn is too much but just putting the stuff directly in a field in...

> The official GraphQL Foundation [GraphQL over HTTP spec](https://github.com/graphql/graphql-over-http/blob/main/spec/GraphQLOverHTTP.md) (still a draft) does in fact require servers and clients to support JSON: I see, didn't know about this spec. Why...

> All that said, an approach that could work and generally be safe would be hashing only the public components of RsaPrivateKey. That should work I guess.