I read a number of blog posts and found that it is tough to keep the secret-key a secret and if using a symmetric algorithm for JWT creation, the generator has the power to create as well as validate the JWT. This seems a place where it may be misused.
This brings in picture RSA-based (asymmetric algorithm for JWT creation). These JWT seem to be a better choice if we want single authority for JWT creation.
When should one use HMAC-based JWT?
It would be so nice if you could give an example scenario.