If you trust the token generator and just worry about tampering in transit, signing the tokens after the fact is a fine solution.
This work is about the case where you trust nobody and therefore require even the token generator to do extra bookkeeping to prove that it's not taking any shortcuts.
Not my area of expertise, can someone please explain why they can’t just digitally sign the generated tokens?
If you trust the token generator and just worry about tampering in transit, signing the tokens after the fact is a fine solution.
This work is about the case where you trust nobody and therefore require even the token generator to do extra bookkeeping to prove that it's not taking any shortcuts.