How do I nest a signed JWT in an encrypted JWT?

[Evertt]

I swear I first used the search function, but the threads that came up didn't seem to be about my question specifically.

I think I almost understand how to do it.. I'm just missing one or two essential bits of information. In this article, which is about a Java version of Jose, they explain that when you're nesting a signed JWT into an encrypted JWT, you need to specify during the building of the encrypted JWT that the content type is a JWT.

I don't see a method documented here that allows me to do that.

I believe I could also skip that step completely and just encrypt the signed JWT as if it were an arbitrary string. But I'd like to do things the canonical way if I can. So is there a more canonical way of nesting a signed JWT inside an encrypted JWT with jose?

[panva]

I don't see a method documented here that allows me to do that.

.setProtectedHeader({ cty: 'JWT', ...rest })

An example, without setting the content-type is in #112

[Evertt]

Thanks, that solves that question. Can I ask one last one? Why does generateKeyPair() only generate a key pair that can be used for signing? Is there also a way to generate a key pair for encrypting?

[panva]

What makes you think generateKeyPair() only generates a key pair that can be used for signing?

[Evertt]

Sorry, I was using the wrong algorithm I now realize.