How not to sign a JSON object