Signing keys off the heap: JWTs signed and checked with an HMAC key (HS256/384/512), signed with an RSA or EC private key (RS, PS, ES) held by OpenSSL, and webhook signatures (GitHub, Stripe, any HMAC) checked - the key read from a secret provider into native memory and never a byte[] or a Key object on the heap.