biscuit VS paseto

No, it isn't the third release of a POSIX like OS research written in Go,

https://github.com/mit-pdos/biscuit

But there are other brave people exists like biscuit or gopher-os who can do it :)))

That's something I found in doing a bit of a dive on why ripgrep is so fast at doing a very specific kind of string search workload (Gallant / burntsushi / author of ripgrep is an actual wizard and contributes to Rust's regex engines, for reference). I wrote tiny proof of concepts in a variety of languages, all in my same style -- and sometimes my Go variants were as fast as the equivalent Rust/C (even in release / -O3/2 (every once in a blue moon, O3 makes no diff or is a slight regression in some exec paths)). I eventually found something about benchmarks in a related area, leading to this: https://benhoyt.com/writings/count-words/#performance-results-and-learnings. Somebody on the Go sub even linked me to the Biscuit OS: https://pdos.csail.mit.edu/papers/biscuit.pdf, which, tidbit, has Jon Gjengset (Crust of Rust legend) in the contribs list (https://github.com/mit-pdos/biscuit).

https://github.com/mit-pdos/biscuit maybe this

Go has been used to implement OS kernel code, e.g. in the Biscuit OS from MIT: https://github.com/mit-pdos/biscuit

Of course, the garbage collector did not exactly make it easier - but it's an interesting piece of software.

https://github.com/mit-pdos/biscuit says 5% slowdown over C. Garbage collection is going to require some more RAM, generally <=2x though.

Might I suggest Paseto (https://paseto.io/) - it solves a lot of the headaches of JWT. Signing and encryption are two different things that require two different sets of keys, so you can't mess it up.

(Full disclosure, I've written one implementation: https://github.com/auth70/paseto-ts)

Though we'll be building a session-based authentication system, it's noteworthy that with the introduction of some concepts which will be discussed in due time, you can turn it into JWT- or, more securely and appropriately, PASETO-based authentication system.

Time we ditch it and use paseto

The PASETO web site goes over it. Mostly it's designed to make you do things the right way and avoid all the security holes you can fall into with JWT.

If this is too much to handle, you shouldn't have to! There's already solutions that handle it for you