Stefan Aebischer

> only if secretOrKeyProvider is set to a function that sets a non truthy value for secretOrKey (eg (req, token, cb) => cb()), I could get unsigned tokens to be...

> Does this mean that a secret is now always required? I have a use case to use a JWT that is unsigned (None algorithm). Is there any way to...

> What's the most motivating use case for this? There was a question "how to persists parent's state when children change" in discord today. Observers of the parent actor won't...

> If we remove the first parameter, then 1) we don't have explicit names for steps Maybe `name` could be inferred from named functions, and overridden by `name` attribute? ```ts...

> I guess depending 'name' property of constructor or instance could make confusion for production as names are mingled formally? That might indeed be problematic for visualization.

> For backward compatibility the non-hashed version is also looked up @hf Couldn't an attacker just send the hashed token (from DB) as the non-hashed token (in Request) and mint...

Have a look at this example: https://github.com/auth0/node-jwks-rsa/blob/master/examples/passport-demo/README.md