The [less preferred approach](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/differences-between-github-apps-and-oauth-apps) to signing, but still a valid approach. Spec: - Should not be the default approach. - Should support a known default set of scopes (GH CLI is a good reference as it is still using the OAuth approach).