By: Tom Sydney Kerckhove <syd@cs-syd.eu>
Say that Wise refused the signature, not that it never asked for one A rejected signature comes back as a second 403 that carries the rejection but no fresh token, which the old code read as an ordinary failure and reported as a request that was never challenged. That sent the reader looking at the wrong request: the signature had been built and sent, and the account's registered public key was what was wrong.