
Quoting from the PURR:
polyproto uses JavaScript Object Notation (JSON) as the default format for interchange of data wherever feasible. This is because JSON is the most widely adopted data interchange format in a web-application context, facilitating the protocols ease of adoption.
Digital signatures over JSON data are only verifiable if signer and verifier compute the signature over byte-identical input. Because JSON permits multiple valid serializations of the same logical data (differing key order, whitespace, or number formatting), signing "JSON" without exactly defining its byte representation makes signatures non-reproducible and, in some implementations, exploitable via canonicalization mismatches.
