diff --git a/.github/release-please.yml b/.github/release-please.yml
deleted file mode 100644
index 0a6e0cc2..00000000
--- a/.github/release-please.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-releaseType: simple
-handleGHRelease: true
-primaryBranch: main 
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
new file mode 100644
index 00000000..409df545
--- /dev/null
+++ b/.github/workflows/release-please.yml
@@ -0,0 +1,19 @@
+name: release-please
+on:
+  push:
+    branches:
+      - main
+permissions:
+  # Needed for Release Please to create and update files
+  contents: write
+  # Needed for Release Please to create Release PRs
+  pull-requests: write
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v4
+        id: release
+        with:
+          token: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
+          release-type: simple
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index b29c8018..6e0cd3c1 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        php: [ "7.4", "8.0", "8.1", "8.2" ]
+        php: [ "8.0", "8.1", "8.2", "8.3", "8.4" ]
     name: PHP ${{matrix.php }} Unit Test
     steps:
       - uses: actions/checkout@v2
@@ -35,7 +35,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: "8.0"
+          php-version: "8.3"
       - name: Run Script
         run: |
           composer global require friendsofphp/php-cs-fixer
@@ -49,9 +49,9 @@ jobs:
     - name: Install PHP
       uses: shivammathur/setup-php@v2
       with:
-        php-version: '8.0'
+        php-version: '8.3'
     - name: Run Script
       run: |
         composer install
-        composer global require phpstan/phpstan
+        composer global require phpstan/phpstan:~1.10.0
         ~/.composer/vendor/bin/phpstan analyse
diff --git a/.php-cs-fixer.dist.php b/.php-cs-fixer.dist.php
index fb636632..93ff7a4c 100644
--- a/.php-cs-fixer.dist.php
+++ b/.php-cs-fixer.dist.php
@@ -16,6 +16,10 @@
         'native_function_invocation' => [
             'strict' => false
         ],
+        'nullable_type_declaration' => [
+            'syntax' => 'question_mark',
+        ],
+        'nullable_type_declaration_for_default_null_value' => true,
     ])
     ->setFinder(
         PhpCsFixer\Finder::create()
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 353766ee..26376076 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,78 @@
 # Changelog
 
+## [7.0.2](https://github.com/firebase/php-jwt/compare/v7.0.1...v7.0.2) (2025-12-16)
+
+
+### Bug Fixes
+
+* add key length validation for ec keys ([#615](https://github.com/firebase/php-jwt/issues/615)) ([7044f9a](https://github.com/firebase/php-jwt/commit/7044f9ae7e7d175d28cca71714feb236f1c0e252))
+
+## [7.0.0](https://github.com/firebase/php-jwt/compare/v6.11.1...v7.0.0) (2025-12-15)
+
+
+### ⚠️ ⚠️ ⚠️  Security Fixes ⚠️ ⚠️ ⚠️ 
+ * add key size validation ([#613](https://github.com/firebase/php-jwt/issues/613)) ([6b80341](https://github.com/firebase/php-jwt/commit/6b80341bf57838ea2d011487917337901cd71576))
+ **NOTE**: This fix will cause keys with a size below the minimally allowed size to break. 
+
+### Features
+
+* add SensitiveParameter attribute to security-critical parameters ([#603](https://github.com/firebase/php-jwt/issues/603)) ([4dbfac0](https://github.com/firebase/php-jwt/commit/4dbfac0260eeb0e9e643063c99998e3219cc539b))
+* store timestamp in `ExpiredException` ([#604](https://github.com/firebase/php-jwt/issues/604)) ([f174826](https://github.com/firebase/php-jwt/commit/f1748260d218a856b6a0c23715ac7fae1d7ca95b))
+
+
+### Bug Fixes
+
+* validate iat and nbf on payload ([#568](https://github.com/firebase/php-jwt/issues/568)) ([953b2c8](https://github.com/firebase/php-jwt/commit/953b2c88bb445b7e3bb82a5141928f13d7343afd))
+
+## [6.11.1](https://github.com/firebase/php-jwt/compare/v6.11.0...v6.11.1) (2025-04-09)
+
+
+### Bug Fixes
+
+* update error text for consistency ([#528](https://github.com/firebase/php-jwt/issues/528)) ([c11113a](https://github.com/firebase/php-jwt/commit/c11113afa13265e016a669e75494b9203b8a7775))
+
+## [6.11.0](https://github.com/firebase/php-jwt/compare/v6.10.2...v6.11.0) (2025-01-23)
+
+
+### Features
+
+* support octet typed JWK ([#587](https://github.com/firebase/php-jwt/issues/587)) ([7cb8a26](https://github.com/firebase/php-jwt/commit/7cb8a265fa81edf2fa6ef8098f5bc5ae573c33ad))
+
+
+### Bug Fixes
+
+* refactor constructor Key to use PHP 8.0 syntax ([#577](https://github.com/firebase/php-jwt/issues/577)) ([29fa2ce](https://github.com/firebase/php-jwt/commit/29fa2ce9e0582cd397711eec1e80c05ce20fabca))
+
+## [6.10.2](https://github.com/firebase/php-jwt/compare/v6.10.1...v6.10.2) (2024-11-24)
+
+
+### Bug Fixes
+
+* Mitigate PHP8.4 deprecation warnings ([#570](https://github.com/firebase/php-jwt/issues/570)) ([76808fa](https://github.com/firebase/php-jwt/commit/76808fa227f3811aa5cdb3bf81233714b799a5b5))
+* support php 8.4 ([#583](https://github.com/firebase/php-jwt/issues/583)) ([e3d68b0](https://github.com/firebase/php-jwt/commit/e3d68b044421339443c74199edd020e03fb1887e))
+
+## [6.10.1](https://github.com/firebase/php-jwt/compare/v6.10.0...v6.10.1) (2024-05-18)
+
+
+### Bug Fixes
+
+* ensure ratelimit expiry is set every time ([#556](https://github.com/firebase/php-jwt/issues/556)) ([09cb208](https://github.com/firebase/php-jwt/commit/09cb2081c2c3bc0f61e2f2a5fbea5741f7498648))
+* ratelimit cache expiration ([#550](https://github.com/firebase/php-jwt/issues/550)) ([dda7250](https://github.com/firebase/php-jwt/commit/dda725033585ece30ff8cae8937320d7e9f18bae))
+
+## [6.10.0](https://github.com/firebase/php-jwt/compare/v6.9.0...v6.10.0) (2023-11-28)
+
+
+### Features
+
+* allow typ header override ([#546](https://github.com/firebase/php-jwt/issues/546)) ([79cb30b](https://github.com/firebase/php-jwt/commit/79cb30b729a22931b2fbd6b53f20629a83031ba9))
+
+## [6.9.0](https://github.com/firebase/php-jwt/compare/v6.8.1...v6.9.0) (2023-10-04)
+
+
+### Features
+
+* add payload to jwt exception ([#521](https://github.com/firebase/php-jwt/issues/521)) ([175edf9](https://github.com/firebase/php-jwt/commit/175edf958bb61922ec135b2333acf5622f2238a2))
+
 ## [6.8.1](https://github.com/firebase/php-jwt/compare/v6.8.0...v6.8.1) (2023-07-14)
 
 
diff --git a/README.md b/README.md
index 701de23a..65b6c860 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,7 @@ composer require firebase/php-jwt
 ```
 
 Optionally, install the `paragonie/sodium_compat` package from composer if your
-php is < 7.2 or does not have libsodium installed:
+php env does not have libsodium installed:
 
 ```bash
 composer require paragonie/sodium_compat
@@ -48,7 +48,8 @@ $decoded = JWT::decode($jwt, new Key($key, 'HS256'));
 print_r($decoded);
 
 // Pass a stdClass in as the third parameter to get the decoded header values
-$decoded = JWT::decode($jwt, new Key($key, 'HS256'), $headers = new stdClass());
+$headers = new stdClass();
+$decoded = JWT::decode($jwt, new Key($key, 'HS256'), $headers);
 print_r($headers);
 
 /*
@@ -185,7 +186,7 @@ $passphrase = '[YOUR_PASSPHRASE]';
 // Can be generated with "ssh-keygen -t rsa -m pem"
 $privateKeyFile = '/path/to/key-with-passphrase.pem';
 
-// Create a private key of type "resource"
+/** @var OpenSSLAsymmetricKey $privateKey */
 $privateKey = openssl_pkey_get_private(
     file_get_contents($privateKeyFile),
     $passphrase
@@ -290,7 +291,7 @@ $jwks = ['keys' => []];
 
 // JWK::parseKeySet($jwks) returns an associative array of **kid** to Firebase\JWT\Key
 // objects. Pass this as the second parameter to JWT::decode.
-JWT::decode($payload, JWK::parseKeySet($jwks));
+JWT::decode($jwt, JWK::parseKeySet($jwks));
 ```
 
 Using Cached Key Sets
@@ -349,7 +350,7 @@ use InvalidArgumentException;
 use UnexpectedValueException;
 
 try {
-    $decoded = JWT::decode($payload, $keys);
+    $decoded = JWT::decode($jwt, $keys);
 } catch (InvalidArgumentException $e) {
     // provided key/key-array is empty or malformed.
 } catch (DomainException $e) {
@@ -379,7 +380,7 @@ like this:
 use Firebase\JWT\JWT;
 use UnexpectedValueException;
 try {
-    $decoded = JWT::decode($payload, $keys);
+    $decoded = JWT::decode($jwt, $keys);
 } catch (LogicException $e) {
     // errors having to do with environmental setup or malformed JWT Keys
 } catch (UnexpectedValueException $e) {
@@ -394,7 +395,7 @@ instead, you can do the following:
 
 ```php
 // return type is stdClass
-$decoded = JWT::decode($payload, $keys);
+$decoded = JWT::decode($jwt, $keys);
 
 // cast to array
 $decoded = json_decode(json_encode($decoded), true);
diff --git a/composer.json b/composer.json
index e23dfe37..816cfd0b 100644
--- a/composer.json
+++ b/composer.json
@@ -20,7 +20,7 @@
     ],
     "license": "BSD-3-Clause",
     "require": {
-        "php": "^7.4||^8.0"
+        "php": "^8.0"
     },
     "suggest": {
         "paragonie/sodium_compat": "Support EdDSA (Ed25519) signatures when libsodium is not present",
@@ -32,10 +32,10 @@
         }
     },
     "require-dev": {
-        "guzzlehttp/guzzle": "^6.5||^7.4",
+        "guzzlehttp/guzzle": "^7.4",
         "phpspec/prophecy-phpunit": "^2.0",
         "phpunit/phpunit": "^9.5",
-        "psr/cache": "^1.0||^2.0",
+        "psr/cache": "^2.0||^3.0",
         "psr/http-client": "^1.0",
         "psr/http-factory": "^1.0"
     }
diff --git a/src/BeforeValidException.php b/src/BeforeValidException.php
index c147852b..595164bf 100644
--- a/src/BeforeValidException.php
+++ b/src/BeforeValidException.php
@@ -2,6 +2,17 @@
 
 namespace Firebase\JWT;
 
-class BeforeValidException extends \UnexpectedValueException
+class BeforeValidException extends \UnexpectedValueException implements JWTExceptionWithPayloadInterface
 {
+    private object $payload;
+
+    public function setPayload(object $payload): void
+    {
+        $this->payload = $payload;
+    }
+
+    public function getPayload(): object
+    {
+        return $this->payload;
+    }
 }
diff --git a/src/CachedKeySet.php b/src/CachedKeySet.php
index ee529f9f..8e8e8d68 100644
--- a/src/CachedKeySet.php
+++ b/src/CachedKeySet.php
@@ -80,9 +80,9 @@ public function __construct(
         ClientInterface $httpClient,
         RequestFactoryInterface $httpFactory,
         CacheItemPoolInterface $cache,
-        int $expiresAfter = null,
+        ?int $expiresAfter = null,
         bool $rateLimit = false,
-        string $defaultAlg = null
+        ?string $defaultAlg = null
     ) {
         $this->jwksUri = $jwksUri;
         $this->httpClient = $httpClient;
@@ -180,7 +180,7 @@ private function keyIdExists(string $keyId): bool
             $jwksResponse = $this->httpClient->sendRequest($request);
             if ($jwksResponse->getStatusCode() !== 200) {
                 throw new UnexpectedValueException(
-                    sprintf('HTTP Error: %d %s for URI "%s"',
+                    \sprintf('HTTP Error: %d %s for URI "%s"',
                         $jwksResponse->getStatusCode(),
                         $jwksResponse->getReasonPhrase(),
                         $this->jwksUri,
@@ -212,15 +212,21 @@ private function rateLimitExceeded(): bool
         }
 
         $cacheItem = $this->cache->getItem($this->rateLimitCacheKey);
-        if (!$cacheItem->isHit()) {
-            $cacheItem->expiresAfter(1); // # of calls are cached each minute
+
+        $cacheItemData = [];
+        if ($cacheItem->isHit() && \is_array($data = $cacheItem->get())) {
+            $cacheItemData = $data;
         }
 
-        $callsPerMinute = (int) $cacheItem->get();
+        $callsPerMinute = $cacheItemData['callsPerMinute'] ?? 0;
+        $expiry = $cacheItemData['expiry'] ?? new \DateTime('+60 seconds', new \DateTimeZone('UTC'));
+
         if (++$callsPerMinute > $this->maxCallsPerMinute) {
             return true;
         }
-        $cacheItem->set($callsPerMinute);
+
+        $cacheItem->set(['expiry' => $expiry, 'callsPerMinute' => $callsPerMinute]);
+        $cacheItem->expiresAt($expiry);
         $this->cache->save($cacheItem);
         return false;
     }
diff --git a/src/ExpiredException.php b/src/ExpiredException.php
index 81ba52d4..25f44513 100644
--- a/src/ExpiredException.php
+++ b/src/ExpiredException.php
@@ -2,6 +2,29 @@
 
 namespace Firebase\JWT;
 
-class ExpiredException extends \UnexpectedValueException
+class ExpiredException extends \UnexpectedValueException implements JWTExceptionWithPayloadInterface
 {
+    private object $payload;
+
+    private ?int $timestamp = null;
+
+    public function setPayload(object $payload): void
+    {
+        $this->payload = $payload;
+    }
+
+    public function getPayload(): object
+    {
+        return $this->payload;
+    }
+
+    public function setTimestamp(int $timestamp): void
+    {
+        $this->timestamp = $timestamp;
+    }
+
+    public function getTimestamp(): ?int
+    {
+        return $this->timestamp;
+    }
 }
diff --git a/src/JWK.php b/src/JWK.php
index 63fb2484..d5175b21 100644
--- a/src/JWK.php
+++ b/src/JWK.php
@@ -52,7 +52,7 @@ class JWK
      *
      * @uses parseKey
      */
-    public static function parseKeySet(array $jwks, string $defaultAlg = null): array
+    public static function parseKeySet(#[\SensitiveParameter] array $jwks, ?string $defaultAlg = null): array
     {
         $keys = [];
 
@@ -93,7 +93,7 @@ public static function parseKeySet(array $jwks, string $defaultAlg = null): arra
      *
      * @uses createPemFromModulusAndExponent
      */
-    public static function parseKey(array $jwk, string $defaultAlg = null): ?Key
+    public static function parseKey(#[\SensitiveParameter] array $jwk, ?string $defaultAlg = null): ?Key
     {
         if (empty($jwk)) {
             throw new InvalidArgumentException('JWK must not be empty');
@@ -172,6 +172,12 @@ public static function parseKey(array $jwk, string $defaultAlg = null): ?Key
                 // This library works internally with EdDSA keys (Ed25519) encoded in standard base64.
                 $publicKey = JWT::convertBase64urlToBase64($jwk['x']);
                 return new Key($publicKey, $jwk['alg']);
+            case 'oct':
+                if (!isset($jwk['k'])) {
+                    throw new UnexpectedValueException('k not set');
+                }
+
+                return new Key(JWT::urlsafeB64Decode($jwk['k']), $jwk['alg']);
             default:
                 break;
         }
@@ -212,7 +218,7 @@ private static function createPemFromCrvAndXYCoordinates(string $crv, string $x,
                 )
             );
 
-        return sprintf(
+        return \sprintf(
             "-----BEGIN PUBLIC KEY-----\n%s\n-----END PUBLIC KEY-----\n",
             wordwrap(base64_encode($pem), 64, "\n", true)
         );
diff --git a/src/JWT.php b/src/JWT.php
index 18927452..c18e4cc0 100644
--- a/src/JWT.php
+++ b/src/JWT.php
@@ -31,6 +31,8 @@ class JWT
     private const ASN1_SEQUENCE = 0x10;
     private const ASN1_BIT_STRING = 0x03;
 
+    private const RSA_KEY_MIN_LENGTH=2048;
+
     /**
      * When checking nbf, iat or expiration times,
      * we want to provide some extra leeway time to
@@ -95,8 +97,8 @@ class JWT
      */
     public static function decode(
         string $jwt,
-        $keyOrKeyArray,
-        stdClass &$headers = null
+        #[\SensitiveParameter] $keyOrKeyArray,
+        ?stdClass &$headers = null
     ): stdClass {
         // Validate JWT
         $timestamp = \is_null(static::$timestamp) ? \time() : static::$timestamp;
@@ -127,6 +129,16 @@ public static function decode(
         if (!$payload instanceof stdClass) {
             throw new UnexpectedValueException('Payload must be a JSON object');
         }
+        if (isset($payload->iat) && !\is_numeric($payload->iat)) {
+            throw new UnexpectedValueException('Payload iat must be a number');
+        }
+        if (isset($payload->nbf) && !\is_numeric($payload->nbf)) {
+            throw new UnexpectedValueException('Payload nbf must be a number');
+        }
+        if (isset($payload->exp) && !\is_numeric($payload->exp)) {
+            throw new UnexpectedValueException('Payload exp must be a number');
+        }
+
         $sig = static::urlsafeB64Decode($cryptob64);
         if (empty($header->alg)) {
             throw new UnexpectedValueException('Empty algorithm');
@@ -153,23 +165,30 @@ public static function decode(
         // Check the nbf if it is defined. This is the time that the
         // token can actually be used. If it's not yet that time, abort.
         if (isset($payload->nbf) && floor($payload->nbf) > ($timestamp + static::$leeway)) {
-            throw new BeforeValidException(
-                'Cannot handle token with nbf prior to ' . \date(DateTime::ISO8601, (int) $payload->nbf)
+            $ex = new BeforeValidException(
+                'Cannot handle token with nbf prior to ' . \date(DateTime::ATOM, (int) floor($payload->nbf))
             );
+            $ex->setPayload($payload);
+            throw $ex;
         }
 
         // Check that this token has been created before 'now'. This prevents
         // using tokens that have been created for later use (and haven't
         // correctly used the nbf claim).
         if (!isset($payload->nbf) && isset($payload->iat) && floor($payload->iat) > ($timestamp + static::$leeway)) {
-            throw new BeforeValidException(
-                'Cannot handle token with iat prior to ' . \date(DateTime::ISO8601, (int) $payload->iat)
+            $ex = new BeforeValidException(
+                'Cannot handle token with iat prior to ' . \date(DateTime::ATOM, (int) floor($payload->iat))
             );
+            $ex->setPayload($payload);
+            throw $ex;
         }
 
         // Check if this token has expired.
         if (isset($payload->exp) && ($timestamp - static::$leeway) >= $payload->exp) {
-            throw new ExpiredException('Expired token');
+            $ex = new ExpiredException('Expired token');
+            $ex->setPayload($payload);
+            $ex->setTimestamp($timestamp);
+            throw $ex;
         }
 
         return $payload;
@@ -179,7 +198,7 @@ public static function decode(
      * Converts and signs a PHP array into a JWT string.
      *
      * @param array<mixed>          $payload PHP array
-     * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate $key The secret key.
+     * @param string|OpenSSLAsymmetricKey|OpenSSLCertificate $key The secret key.
      * @param string                $alg     Supported algorithms are 'ES384','ES256', 'ES256K', 'HS256',
      *                                       'HS384', 'HS512', 'RS256', 'RS384', and 'RS512'
      * @param string                $keyId
@@ -192,18 +211,19 @@ public static function decode(
      */
     public static function encode(
         array $payload,
-        $key,
+        #[\SensitiveParameter] $key,
         string $alg,
-        string $keyId = null,
-        array $head = null
+        ?string $keyId = null,
+        ?array $head = null
     ): string {
-        $header = ['typ' => 'JWT', 'alg' => $alg];
+        $header = ['typ' => 'JWT'];
+        if (isset($head)) {
+            $header = \array_merge($header, $head);
+        }
+        $header['alg'] = $alg;
         if ($keyId !== null) {
             $header['kid'] = $keyId;
         }
-        if (isset($head) && \is_array($head)) {
-            $header = \array_merge($head, $header);
-        }
         $segments = [];
         $segments[] = static::urlsafeB64Encode((string) static::jsonEncode($header));
         $segments[] = static::urlsafeB64Encode((string) static::jsonEncode($payload));
@@ -219,7 +239,7 @@ public static function encode(
      * Sign a string with a given key and algorithm.
      *
      * @param string $msg  The message to sign
-     * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate  $key  The secret key.
+     * @param string|OpenSSLAsymmetricKey|OpenSSLCertificate  $key  The secret key.
      * @param string $alg  Supported algorithms are 'EdDSA', 'ES384', 'ES256', 'ES256K', 'HS256',
      *                    'HS384', 'HS512', 'RS256', 'RS384', and 'RS512'
      *
@@ -229,7 +249,7 @@ public static function encode(
      */
     public static function sign(
         string $msg,
-        $key,
+        #[\SensitiveParameter] $key,
         string $alg
     ): string {
         if (empty(static::$supported_algs[$alg])) {
@@ -241,10 +261,19 @@ public static function sign(
                 if (!\is_string($key)) {
                     throw new InvalidArgumentException('key must be a string when using hmac');
                 }
+                self::validateHmacKeyLength($key, $algorithm);
                 return \hash_hmac($algorithm, $msg, $key, true);
             case 'openssl':
                 $signature = '';
-                $success = \openssl_sign($msg, $signature, $key, $algorithm); // @phpstan-ignore-line
+                if (!$key = openssl_pkey_get_private($key)) {
+                    throw new DomainException('OpenSSL unable to validate key');
+                }
+                if (str_starts_with($alg, 'RS')) {
+                    self::validateRsaKeyLength($key);
+                } elseif (str_starts_with($alg, 'ES')) {
+                    self::validateEcKeyLength($key, $alg);
+                }
+                $success = \openssl_sign($msg, $signature, $key, $algorithm);
                 if (!$success) {
                     throw new DomainException('OpenSSL unable to sign data');
                 }
@@ -283,7 +312,7 @@ public static function sign(
      *
      * @param string $msg         The original message (header and body)
      * @param string $signature   The original signature
-     * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate  $keyMaterial For Ed*, ES*, HS*, a string key works. for RS*, must be an instance of OpenSSLAsymmetricKey
+     * @param string|OpenSSLAsymmetricKey|OpenSSLCertificate  $keyMaterial For Ed*, ES*, HS*, a string key works. for RS*, must be an instance of OpenSSLAsymmetricKey
      * @param string $alg         The algorithm
      *
      * @return bool
@@ -293,7 +322,7 @@ public static function sign(
     private static function verify(
         string $msg,
         string $signature,
-        $keyMaterial,
+        #[\SensitiveParameter] $keyMaterial,
         string $alg
     ): bool {
         if (empty(static::$supported_algs[$alg])) {
@@ -303,7 +332,15 @@ private static function verify(
         list($function, $algorithm) = static::$supported_algs[$alg];
         switch ($function) {
             case 'openssl':
-                $success = \openssl_verify($msg, $signature, $keyMaterial, $algorithm); // @phpstan-ignore-line
+                if (!$key = openssl_pkey_get_public($keyMaterial)) {
+                    throw new DomainException('OpenSSL unable to validate key');
+                }
+                if (str_starts_with($alg, 'RS')) {
+                    self::validateRsaKeyLength($key);
+                } elseif (str_starts_with($alg, 'ES')) {
+                    self::validateEcKeyLength($key, $alg);
+                }
+                $success = \openssl_verify($msg, $signature, $keyMaterial, $algorithm);
                 if ($success === 1) {
                     return true;
                 }
@@ -340,6 +377,7 @@ private static function verify(
                 if (!\is_string($keyMaterial)) {
                     throw new InvalidArgumentException('key must be a string when using hmac');
                 }
+                self::validateHmacKeyLength($keyMaterial, $algorithm);
                 $hash = \hash_hmac($algorithm, $msg, $keyMaterial, true);
                 return self::constantTimeEquals($hash, $signature);
         }
@@ -377,12 +415,7 @@ public static function jsonDecode(string $input)
      */
     public static function jsonEncode(array $input): string
     {
-        if (PHP_VERSION_ID >= 50400) {
-            $json = \json_encode($input, \JSON_UNESCAPED_SLASHES);
-        } else {
-            // PHP 5.3 only
-            $json = \json_encode($input);
-        }
+        $json = \json_encode($input, \JSON_UNESCAPED_SLASHES);
         if ($errno = \json_last_error()) {
             self::handleJsonError($errno);
         } elseif ($json === 'null') {
@@ -452,7 +485,7 @@ public static function urlsafeB64Encode(string $input): string
      * @return Key
      */
     private static function getKey(
-        $keyOrKeyArray,
+        #[\SensitiveParameter] $keyOrKeyArray,
         ?string $kid
     ): Key {
         if ($keyOrKeyArray instanceof Key) {
@@ -659,4 +692,57 @@ private static function readDER(string $der, int $offset = 0): array
 
         return [$pos, $data];
     }
+
+    /**
+     * Validate HMAC key length
+     *
+     * @param string $key HMAC key material
+     * @param string $algorithm The algorithm
+     *
+     * @throws DomainException Provided key is too short
+     */
+    private static function validateHmacKeyLength(string $key, string $algorithm): void
+    {
+        $keyLength = \strlen($key) * 8;
+        $minKeyLength = (int) \str_replace('SHA', '', $algorithm);
+        if ($keyLength < $minKeyLength) {
+            throw new DomainException('Provided key is too short');
+        }
+    }
+
+    /**
+     * Validate RSA key length
+     *
+     * @param OpenSSLAsymmetricKey $key RSA key material
+     * @throws DomainException Provided key is too short
+     */
+    private static function validateRsaKeyLength(#[\SensitiveParameter] OpenSSLAsymmetricKey $key): void
+    {
+        if (!$keyDetails = openssl_pkey_get_details($key)) {
+            throw new DomainException('Unable to validate key');
+        }
+        if ($keyDetails['bits'] < self::RSA_KEY_MIN_LENGTH) {
+            throw new DomainException('Provided key is too short');
+        }
+    }
+
+    /**
+     * Validate RSA key length
+     *
+     * @param OpenSSLAsymmetricKey $key RSA key material
+     * @param string $algorithm The algorithm
+     * @throws DomainException Provided key is too short
+     */
+    private static function validateEcKeyLength(
+        #[\SensitiveParameter] OpenSSLAsymmetricKey $key,
+        string $algorithm
+    ): void {
+        if (!$keyDetails = openssl_pkey_get_details($key)) {
+            throw new DomainException('Unable to validate key');
+        }
+        $minKeyLength = (int) \str_replace('ES', '', $algorithm);
+        if ($keyDetails['bits'] < $minKeyLength) {
+            throw new DomainException('Provided key is too short');
+        }
+    }
 }
diff --git a/src/JWTExceptionWithPayloadInterface.php b/src/JWTExceptionWithPayloadInterface.php
new file mode 100644
index 00000000..7933ed68
--- /dev/null
+++ b/src/JWTExceptionWithPayloadInterface.php
@@ -0,0 +1,20 @@
+<?php
+namespace Firebase\JWT;
+
+interface JWTExceptionWithPayloadInterface
+{
+    /**
+     * Get the payload that caused this exception.
+     *
+     * @return object
+     */
+    public function getPayload(): object;
+
+    /**
+     * Get the payload that caused this exception.
+     *
+     * @param object $payload
+     * @return void
+     */
+    public function setPayload(object $payload): void;
+}
diff --git a/src/Key.php b/src/Key.php
index 00cf7f2e..694d3b13 100644
--- a/src/Key.php
+++ b/src/Key.php
@@ -9,26 +9,20 @@
 
 class Key
 {
-    /** @var string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate */
-    private $keyMaterial;
-    /** @var string */
-    private $algorithm;
-
     /**
-     * @param string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate $keyMaterial
+     * @param string|OpenSSLAsymmetricKey|OpenSSLCertificate $keyMaterial
      * @param string $algorithm
      */
     public function __construct(
-        $keyMaterial,
-        string $algorithm
+        #[\SensitiveParameter] private $keyMaterial,
+        private string $algorithm
     ) {
         if (
             !\is_string($keyMaterial)
             && !$keyMaterial instanceof OpenSSLAsymmetricKey
             && !$keyMaterial instanceof OpenSSLCertificate
-            && !\is_resource($keyMaterial)
         ) {
-            throw new TypeError('Key material must be a string, resource, or OpenSSLAsymmetricKey');
+            throw new TypeError('Key material must be a string, OpenSSLCertificate, or OpenSSLAsymmetricKey');
         }
 
         if (empty($keyMaterial)) {
@@ -38,10 +32,6 @@ public function __construct(
         if (empty($algorithm)) {
             throw new InvalidArgumentException('Algorithm must not be empty');
         }
-
-        // TODO: Remove in PHP 8.0 in favor of class constructor property promotion
-        $this->keyMaterial = $keyMaterial;
-        $this->algorithm = $algorithm;
     }
 
     /**
@@ -55,7 +45,7 @@ public function getAlgorithm(): string
     }
 
     /**
-     * @return string|resource|OpenSSLAsymmetricKey|OpenSSLCertificate
+     * @return string|OpenSSLAsymmetricKey|OpenSSLCertificate
      */
     public function getKeyMaterial()
     {
diff --git a/tests/CachedKeySetTest.php b/tests/CachedKeySetTest.php
index 2e4e1f62..39bbc919 100644
--- a/tests/CachedKeySetTest.php
+++ b/tests/CachedKeySetTest.php
@@ -344,7 +344,7 @@ public function testRateLimit()
         $cachedKeySet = new CachedKeySet(
             $this->testJwksUri,
             $this->getMockHttpClient($this->testJwks1, $shouldBeCalledTimes),
-            $factory = $this->getMockHttpFactory($shouldBeCalledTimes),
+            $this->getMockHttpFactory($shouldBeCalledTimes),
             new TestMemoryCacheItemPool(),
             10,  // expires after seconds
             true // enable rate limiting
@@ -358,6 +358,54 @@ public function testRateLimit()
         $this->assertFalse(isset($cachedKeySet[$invalidKid]));
     }
 
+    public function testRateLimitWithExpiresAfter()
+    {
+        // We request the key 17 times, HTTP should only be called 15 times
+        $shouldBeCalledTimes = 10;
+        $cachedTimes = 2;
+        $afterExpirationTimes = 5;
+
+        $totalHttpTimes = $shouldBeCalledTimes + $afterExpirationTimes;
+
+        $cachePool = new TestMemoryCacheItemPool();
+
+        // Instantiate the cached key set
+        $cachedKeySet = new CachedKeySet(
+            $this->testJwksUri,
+            $this->getMockHttpClient($this->testJwks1, $totalHttpTimes),
+            $this->getMockHttpFactory($totalHttpTimes),
+            $cachePool,
+            10,   // expires after seconds
+            true // enable rate limiting
+        );
+
+        // Set the rate limit cache to expire after 1 second
+        $cacheItem = $cachePool->getItem('jwksratelimitjwkshttpsjwk.uri');
+        $cacheItem->set([
+            'expiry' => new \DateTime('+1 second', new \DateTimeZone('UTC')),
+            'callsPerMinute' => 0,
+        ]);
+        $cacheItem->expiresAfter(1);
+        $cachePool->save($cacheItem);
+
+        $invalidKid = 'invalidkey';
+        for ($i = 0; $i < $shouldBeCalledTimes; $i++) {
+            $this->assertFalse(isset($cachedKeySet[$invalidKid]));
+        }
+
+        // The next calls do not call HTTP
+        for ($i = 0; $i < $cachedTimes; $i++) {
+            $this->assertFalse(isset($cachedKeySet[$invalidKid]));
+        }
+
+        sleep(1); // wait for cache to expire
+
+        // These calls DO call HTTP because the cache has expired
+        for ($i = 0; $i < $afterExpirationTimes; $i++) {
+            $this->assertFalse(isset($cachedKeySet[$invalidKid]));
+        }
+    }
+
     /**
      * @dataProvider provideFullIntegration
      */
@@ -466,7 +514,10 @@ final class TestMemoryCacheItemPool implements CacheItemPoolInterface
 
     public function getItem($key): CacheItemInterface
     {
-        return current($this->getItems([$key]));
+        $item = current($this->getItems([$key]));
+        $item->expiresAt(null); // mimic symfony cache behavior
+
+        return $item;
     }
 
     public function getItems(array $keys = []): iterable
@@ -553,7 +604,7 @@ public function getKey(): string
         return $this->key;
     }
 
-    public function get()
+    public function get(): mixed
     {
         return $this->isHit() ? $this->value : null;
     }
@@ -571,7 +622,7 @@ public function isHit(): bool
         return $this->currentTime()->getTimestamp() < $this->expiration->getTimestamp();
     }
 
-    public function set($value)
+    public function set(mixed $value): static
     {
         $this->isHit = true;
         $this->value = $value;
@@ -579,13 +630,13 @@ public function set($value)
         return $this;
     }
 
-    public function expiresAt($expiration)
+    public function expiresAt($expiration): static
     {
         $this->expiration = $expiration;
         return $this;
     }
 
-    public function expiresAfter($time)
+    public function expiresAfter($time): static
     {
         $this->expiration = $this->currentTime()->add(new \DateInterval("PT{$time}S"));
         return $this;
diff --git a/tests/JWKTest.php b/tests/JWKTest.php
index 01082a40..db385c87 100644
--- a/tests/JWKTest.php
+++ b/tests/JWKTest.php
@@ -169,4 +169,64 @@ public function testDecodeByMultiJwkKeySet()
 
         $this->assertSame('bar', $result->sub);
     }
+
+    public function testDecodeByOctetJwkKeySet()
+    {
+        $jwkSet = json_decode(
+            file_get_contents(__DIR__ . '/data/octet-jwkset.json'),
+            true
+        );
+        $keys = JWK::parseKeySet($jwkSet);
+        $payload = ['sub' => 'foo', 'exp' => strtotime('+10 seconds')];
+        foreach ($keys as $keyId => $key) {
+            $msg = JWT::encode($payload, $key->getKeyMaterial(), $key->getAlgorithm(), $keyId);
+            $result = JWT::decode($msg, $keys);
+
+            $this->assertSame('foo', $result->sub);
+        }
+    }
+
+    public function testOctetJwkMissingK()
+    {
+        $this->expectException(UnexpectedValueException::class);
+        $this->expectExceptionMessage('k not set');
+
+        $badJwk = ['kty' => 'oct', 'alg' => 'HS256'];
+        $keys = JWK::parseKeySet(['keys' => [$badJwk]]);
+    }
+
+    public function testParseKey()
+    {
+        // Use a known module and exponent, and ensure it parses as expected
+        $jwk = [
+            'alg' => 'RS256',
+            'kty' => 'RSA',
+            'n' => 'hsYvCPtkUV7SIxwkOkJsJfhwV_CMdXU5i0UmY2QEs-Pa7v0-0y-s4EjEDtsQ8Yow6hc670JhkGBcMzhU4DtrqNGROXebyOse5FX0m0UvWo1qXqNTf28uBKB990mY42Icr8sGjtOw8ajyT9kufbmXi3eZKagKpG0TDGK90oBEfoGzCxoFT87F95liNth_GoyU5S8-G3OqIqLlQCwxkI5s-g2qvg_aooALfh1rhvx2wt4EJVMSrdnxtPQSPAtZBiw5SwCnVglc6OnalVNvAB2JArbqC9GAzzz9pApAk28SYg5a4hPiPyqwRv-4X1CXEK8bO5VesIeRX0oDf7UoM-pVAw',
+            'use' => 'sig',
+            'e' => 'AQAB',
+            'kid' => '838c06c62046c2d948affe137dd5310129f4d5d1'
+        ];
+
+        $key = JWK::parseKey($jwk);
+        $this->assertNotNull($key);
+
+        $openSslKey = $key->getKeyMaterial();
+        $pubKey = openssl_pkey_get_public($openSslKey);
+        $keyData = openssl_pkey_get_details($pubKey);
+
+        $expectedPublicKey = <<<EOF
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhsYvCPtkUV7SIxwkOkJs
+JfhwV/CMdXU5i0UmY2QEs+Pa7v0+0y+s4EjEDtsQ8Yow6hc670JhkGBcMzhU4Dtr
+qNGROXebyOse5FX0m0UvWo1qXqNTf28uBKB990mY42Icr8sGjtOw8ajyT9kufbmX
+i3eZKagKpG0TDGK90oBEfoGzCxoFT87F95liNth/GoyU5S8+G3OqIqLlQCwxkI5s
++g2qvg/aooALfh1rhvx2wt4EJVMSrdnxtPQSPAtZBiw5SwCnVglc6OnalVNvAB2J
+ArbqC9GAzzz9pApAk28SYg5a4hPiPyqwRv+4X1CXEK8bO5VesIeRX0oDf7UoM+pV
+AwIDAQAB
+-----END PUBLIC KEY-----
+
+EOF;
+
+        $this->assertEquals($expectedPublicKey, $keyData['key']);
+    }
 }
diff --git a/tests/JWTTest.php b/tests/JWTTest.php
index 44b3f049..a1dd08a4 100644
--- a/tests/JWTTest.php
+++ b/tests/JWTTest.php
@@ -2,7 +2,6 @@
 
 namespace Firebase\JWT;
 
-use ArrayObject;
 use DomainException;
 use InvalidArgumentException;
 use PHPUnit\Framework\TestCase;
@@ -12,18 +11,31 @@
 
 class JWTTest extends TestCase
 {
+    private Key $hmacKey;
+
+    public function setUp(): void
+    {
+        $this->hmacKey = $this->generateHmac256();
+    }
+
     public function testUrlSafeCharacters()
     {
-        $encoded = JWT::encode(['message' => 'f?'], 'a', 'HS256');
+        $encoded = JWT::encode(['message' => 'f?'], $this->hmacKey->getKeyMaterial(), 'HS256');
         $expected = new stdClass();
         $expected->message = 'f?';
-        $this->assertEquals($expected, JWT::decode($encoded, new Key('a', 'HS256')));
+        $this->assertEquals($expected, JWT::decode($encoded, $this->hmacKey));
     }
 
     public function testMalformedUtf8StringsFail()
     {
         $this->expectException(DomainException::class);
-        JWT::encode(['message' => pack('c', 128)], 'a', 'HS256');
+        JWT::encode(['message' => pack('c', 128)], $this->hmacKey->getKeyMaterial(), 'HS256');
+    }
+
+    public function testInvalidKeyOpensslSignFail()
+    {
+        $this->expectException(DomainException::class);
+        JWT::sign('message', 'invalid key', 'openssl');
     }
 
     public function testMalformedJsonThrowsException()
@@ -39,8 +51,9 @@ public function testExpiredToken()
             'message' => 'abc',
             'exp' => time() - 20, // time in the past
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        JWT::decode($encoded, new Key('my_key', 'HS256'));
+
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        JWT::decode($encoded, $this->hmacKey);
     }
 
     public function testBeforeValidTokenWithNbf()
@@ -50,8 +63,8 @@ public function testBeforeValidTokenWithNbf()
             'message' => 'abc',
             'nbf' => time() + 20, // time in the future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        JWT::decode($encoded, $this->hmacKey);
     }
 
     public function testBeforeValidTokenWithIat()
@@ -61,8 +74,8 @@ public function testBeforeValidTokenWithIat()
             'message' => 'abc',
             'iat' => time() + 20, // time in the future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        JWT::decode($encoded, $this->hmacKey);
     }
 
     public function testValidToken()
@@ -71,8 +84,8 @@ public function testValidToken()
             'message' => 'abc',
             'exp' => time() + JWT::$leeway + 20, // time in the future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        $decoded = JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        $decoded = JWT::decode($encoded, $this->hmacKey);
         $this->assertSame($decoded->message, 'abc');
     }
 
@@ -86,8 +99,8 @@ public function testValidTokenWithLeeway()
             'message' => 'abc',
             'exp' => time() - 20, // time in the past
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        $decoded = JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        $decoded = JWT::decode($encoded, $this->hmacKey);
         $this->assertSame($decoded->message, 'abc');
     }
 
@@ -96,17 +109,74 @@ public function testValidTokenWithLeeway()
      */
     public function testExpiredTokenWithLeeway()
     {
+        $this->expectException(ExpiredException::class);
         JWT::$leeway = 60;
         $payload = [
             'message' => 'abc',
             'exp' => time() - 70, // time far in the past
         ];
-        $this->expectException(ExpiredException::class);
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        $decoded = JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        $decoded = JWT::decode($encoded, $this->hmacKey);
         $this->assertSame($decoded->message, 'abc');
     }
 
+    public function testExpiredExceptionPayload()
+    {
+        $this->expectException(ExpiredException::class);
+        $payload = [
+            'message' => 'abc',
+            'exp' => time() - 100, // time in the past
+        ];
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        try {
+            JWT::decode($encoded, $this->hmacKey);
+        } catch (ExpiredException $e) {
+            $exceptionPayload = (array) $e->getPayload();
+            $this->assertEquals($exceptionPayload, $payload);
+            throw $e;
+        }
+    }
+
+    /**
+     * @runInSeparateProcess
+     */
+    public function testExpiredExceptionTimestamp()
+    {
+        $this->expectException(ExpiredException::class);
+
+        JWT::$timestamp = 98765;
+        $payload = [
+            'message' => 'abc',
+            'exp' => 1234,
+        ];
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+
+        try {
+            JWT::decode($encoded, $this->hmacKey);
+        } catch (ExpiredException $e) {
+            $exTimestamp = $e->getTimestamp();
+            $this->assertSame(98765, $exTimestamp);
+            throw $e;
+        }
+    }
+
+    public function testBeforeValidExceptionPayload()
+    {
+        $this->expectException(BeforeValidException::class);
+        $payload = [
+            'message' => 'abc',
+            'iat' => time() + 100, // time in the future
+        ];
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        try {
+            JWT::decode($encoded, $this->hmacKey);
+        } catch (BeforeValidException $e) {
+            $exceptionPayload = (array) $e->getPayload();
+            $this->assertEquals($exceptionPayload, $payload);
+            throw $e;
+        }
+    }
+
     public function testValidTokenWithNbf()
     {
         $payload = [
@@ -115,8 +185,8 @@ public function testValidTokenWithNbf()
             'exp' => time() + 20, // time in the future
             'nbf' => time() - 20
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        $decoded = JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        $decoded = JWT::decode($encoded, $this->hmacKey);
         $this->assertSame($decoded->message, 'abc');
     }
 
@@ -130,8 +200,8 @@ public function testValidTokenWithNbfLeeway()
             'message' => 'abc',
             'nbf'     => time() + 20, // not before in near (leeway) future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        $decoded = JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        $decoded = JWT::decode($encoded, $this->hmacKey);
         $this->assertSame($decoded->message, 'abc');
     }
 
@@ -145,10 +215,10 @@ public function testInvalidTokenWithNbfLeeway()
             'message' => 'abc',
             'nbf'     => time() + 65,  // not before too far in future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
         $this->expectException(BeforeValidException::class);
         $this->expectExceptionMessage('Cannot handle token with nbf prior to');
-        JWT::decode($encoded, new Key('my_key', 'HS256'));
+        JWT::decode($encoded, $this->hmacKey);
     }
 
     public function testValidTokenWithNbfIgnoresIat()
@@ -158,8 +228,8 @@ public function testValidTokenWithNbfIgnoresIat()
             'nbf' => time() - 20, // time in the future
             'iat' => time() + 20, // time in the past
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        $decoded = JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        $decoded = JWT::decode($encoded, $this->hmacKey);
         $this->assertEquals('abc', $decoded->message);
     }
 
@@ -169,8 +239,8 @@ public function testValidTokenWithNbfMicrotime()
             'message' => 'abc',
             'nbf' => microtime(true), // use microtime
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        $decoded = JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        $decoded = JWT::decode($encoded, $this->hmacKey);
         $this->assertEquals('abc', $decoded->message);
     }
 
@@ -182,8 +252,8 @@ public function testInvalidTokenWithNbfMicrotime()
             'message' => 'abc',
             'nbf' => microtime(true) + 20, // use microtime in the future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        JWT::decode($encoded, $this->hmacKey);
     }
 
     /**
@@ -196,8 +266,8 @@ public function testValidTokenWithIatLeeway()
             'message' => 'abc',
             'iat'     => time() + 20, // issued in near (leeway) future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        $decoded = JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        $decoded = JWT::decode($encoded, $this->hmacKey);
         $this->assertSame($decoded->message, 'abc');
     }
 
@@ -211,10 +281,10 @@ public function testInvalidTokenWithIatLeeway()
             'message' => 'abc',
             'iat'     => time() + 65, // issued too far in future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
         $this->expectException(BeforeValidException::class);
         $this->expectExceptionMessage('Cannot handle token with iat prior to');
-        JWT::decode($encoded, new Key('my_key', 'HS256'));
+        JWT::decode($encoded, $this->hmacKey);
     }
 
     public function testValidTokenWithIatMicrotime()
@@ -223,8 +293,8 @@ public function testValidTokenWithIatMicrotime()
             'message' => 'abc',
             'iat' => microtime(true), // use microtime
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        $decoded = JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        $decoded = JWT::decode($encoded, $this->hmacKey);
         $this->assertEquals('abc', $decoded->message);
     }
 
@@ -236,19 +306,21 @@ public function testInvalidTokenWithIatMicrotime()
             'message' => 'abc',
             'iat' => microtime(true) + 20, // use microtime in the future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        JWT::decode($encoded, new Key('my_key', 'HS256'));
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        JWT::decode($encoded, $this->hmacKey);
     }
 
     public function testInvalidToken()
     {
+        $encodeKey = $this->generateHmac256();
+        $decodeKey = $this->generateHmac256();
         $payload = [
             'message' => 'abc',
             'exp' => time() + 20, // time in the future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
+        $encoded = JWT::encode($payload, $encodeKey->getKeyMaterial(), $encodeKey->getAlgorithm());
         $this->expectException(SignatureInvalidException::class);
-        JWT::decode($encoded, new Key('my_key2', 'HS256'));
+        JWT::decode($encoded, $decodeKey);
     }
 
     public function testNullKeyFails()
@@ -257,7 +329,7 @@ public function testNullKeyFails()
             'message' => 'abc',
             'exp' => time() + JWT::$leeway + 20, // time in the future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
         $this->expectException(TypeError::class);
         JWT::decode($encoded, new Key(null, 'HS256'));
     }
@@ -268,7 +340,7 @@ public function testEmptyKeyFails()
             'message' => 'abc',
             'exp' => time() + JWT::$leeway + 20, // time in the future
         ];
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
         $this->expectException(InvalidArgumentException::class);
         JWT::decode($encoded, new Key('', 'HS256'));
     }
@@ -276,9 +348,9 @@ public function testEmptyKeyFails()
     public function testKIDChooser()
     {
         $keys = [
-            '0' => new Key('my_key0', 'HS256'),
-            '1' => new Key('my_key1', 'HS256'),
-            '2' => new Key('my_key2', 'HS256')
+            '0' => $this->generateHmac256(),
+            '1' => $this->generateHmac256(),
+            '2' => $this->generateHmac256()
         ];
         $msg = JWT::encode(['message' => 'abc'], $keys['0']->getKeyMaterial(), 'HS256', '0');
         $decoded = JWT::decode($msg, $keys);
@@ -289,11 +361,11 @@ public function testKIDChooser()
 
     public function testArrayAccessKIDChooser()
     {
-        $keys = new ArrayObject([
-            '0' => new Key('my_key0', 'HS256'),
-            '1' => new Key('my_key1', 'HS256'),
-            '2' => new Key('my_key2', 'HS256'),
-        ]);
+        $keys = [
+            '0' => $this->generateHmac256(),
+            '1' => $this->generateHmac256(),
+            '2' => $this->generateHmac256()
+        ];
         $msg = JWT::encode(['message' => 'abc'], $keys['0']->getKeyMaterial(), 'HS256', '0');
         $decoded = JWT::decode($msg, $keys);
         $expected = new stdClass();
@@ -303,59 +375,62 @@ public function testArrayAccessKIDChooser()
 
     public function testNoneAlgorithm()
     {
-        $msg = JWT::encode(['message' => 'abc'], 'my_key', 'HS256');
+        $msg = JWT::encode(['message' => 'abc'], $this->hmacKey->getKeyMaterial(), 'HS256');
         $this->expectException(UnexpectedValueException::class);
-        JWT::decode($msg, new Key('my_key', 'none'));
+        JWT::decode($msg, new Key($this->hmacKey->getKeyMaterial(), 'none'));
     }
 
     public function testIncorrectAlgorithm()
     {
-        $msg = JWT::encode(['message' => 'abc'], 'my_key', 'HS256');
+        $msg = JWT::encode(['message' => 'abc'], $this->hmacKey->getKeyMaterial(), 'HS256');
         $this->expectException(UnexpectedValueException::class);
-        JWT::decode($msg, new Key('my_key', 'RS256'));
+        // TODO: Generate proper RS256 key
+        JWT::decode($msg, new Key($this->hmacKey->getKeyMaterial(), 'RS256'));
     }
 
     public function testEmptyAlgorithm()
     {
-        $msg = JWT::encode(['message' => 'abc'], 'my_key', 'HS256');
+        $msg = JWT::encode(['message' => 'abc'], $this->hmacKey->getKeyMaterial(), 'HS256');
         $this->expectException(InvalidArgumentException::class);
-        JWT::decode($msg, new Key('my_key', ''));
+        JWT::decode($msg, new Key($this->hmacKey->getKeyMaterial(), ''));
     }
 
     public function testAdditionalHeaders()
     {
-        $msg = JWT::encode(['message' => 'abc'], 'my_key', 'HS256', null, ['cty' => 'test-eit;v=1']);
+        $msg = JWT::encode(['message' => 'abc'], $this->hmacKey->getKeyMaterial(), 'HS256', null, ['cty' => 'test-eit;v=1']);
         $expected = new stdClass();
         $expected->message = 'abc';
-        $this->assertEquals(JWT::decode($msg, new Key('my_key', 'HS256')), $expected);
+        $this->assertEquals(JWT::decode($msg, $this->hmacKey), $expected);
     }
 
     public function testInvalidSegmentCount()
     {
         $this->expectException(UnexpectedValueException::class);
-        JWT::decode('brokenheader.brokenbody', new Key('my_key', 'HS256'));
+        JWT::decode('brokenheader.brokenbody', $this->hmacKey);
     }
 
     public function testInvalidSignatureEncoding()
     {
         $msg = 'eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6MSwibmFtZSI6ImZvbyJ9.Q4Kee9E8o0Xfo4ADXvYA8t7dN_X_bU9K5w6tXuiSjlUxx';
         $this->expectException(UnexpectedValueException::class);
-        JWT::decode($msg, new Key('secret', 'HS256'));
+        JWT::decode($msg, $this->hmacKey);
     }
 
     public function testHSEncodeDecode()
     {
-        $msg = JWT::encode(['message' => 'abc'], 'my_key', 'HS256');
+        $msg = JWT::encode(['message' => 'abc'], $this->hmacKey->getKeyMaterial(), 'HS256');
         $expected = new stdClass();
         $expected->message = 'abc';
-        $this->assertEquals(JWT::decode($msg, new Key('my_key', 'HS256')), $expected);
+        $this->assertEquals(JWT::decode($msg, $this->hmacKey), $expected);
     }
 
     public function testRSEncodeDecode()
     {
-        $privKey = openssl_pkey_new(['digest_alg' => 'sha256',
-            'private_key_bits' => 1024,
-            'private_key_type' => OPENSSL_KEYTYPE_RSA]);
+        $privKey = openssl_pkey_new([
+            'digest_alg' => 'sha256',
+            'private_key_bits' => 2048,
+            'private_key_type' => OPENSSL_KEYTYPE_RSA
+        ]);
         $msg = JWT::encode(['message' => 'abc'], $privKey, 'RS256');
         $pubKey = openssl_pkey_get_details($privKey);
         $pubKey = $pubKey['key'];
@@ -455,17 +530,17 @@ public function provideEncodeDecode()
         ];
     }
 
-    public function testEncodeDecodeWithResource()
+    public function testEncodeDecodeWithOpenSSLAsymmetricKey()
     {
         $pem = file_get_contents(__DIR__ . '/data/rsa1-public.pub');
-        $resource = openssl_pkey_get_public($pem);
+        $keyMaterial = openssl_pkey_get_public($pem);
         $privateKey = file_get_contents(__DIR__ . '/data/rsa1-private.pem');
 
         $payload = ['foo' => 'bar'];
         $encoded = JWT::encode($payload, $privateKey, 'RS512');
 
         // Verify decoding succeeds
-        $decoded = JWT::decode($encoded, new Key($resource, 'RS512'));
+        $decoded = JWT::decode($encoded, new Key($keyMaterial, 'RS512'));
 
         $this->assertSame('bar', $decoded->foo);
     }
@@ -478,10 +553,192 @@ public function testGetHeaders()
         ];
         $headers = new stdClass();
 
-        $encoded = JWT::encode($payload, 'my_key', 'HS256');
-        JWT::decode($encoded, new Key('my_key', 'HS256'), $headers);
+        $encoded = JWT::encode($payload, $this->hmacKey->getKeyMaterial(), 'HS256');
+        JWT::decode($encoded, $this->hmacKey, $headers);
 
         $this->assertEquals($headers->typ, 'JWT');
         $this->assertEquals($headers->alg, 'HS256');
     }
+
+    public function testAdditionalHeaderOverrides()
+    {
+        $msg = JWT::encode(
+            ['message' => 'abc'],
+            $this->hmacKey->getKeyMaterial(),
+            'HS256',
+            'my_key_id',
+            [
+                'cty' => 'test-eit;v=1',
+                'typ' => 'JOSE', // override type header
+                'kid' => 'not_my_key_id', // should not override $key param
+                'alg' => 'BAD', // should not override $alg param
+            ]
+        );
+        $headers = new stdClass();
+        JWT::decode($msg, $this->hmacKey, $headers);
+        $this->assertEquals('test-eit;v=1', $headers->cty, 'additional field works');
+        $this->assertEquals('JOSE', $headers->typ, 'typ override works');
+        $this->assertEquals('my_key_id', $headers->kid, 'key param not overridden');
+        $this->assertEquals('HS256', $headers->alg, 'alg param not overridden');
+    }
+
+    public function testDecodeExpectsIntegerIat()
+    {
+        $this->expectException(UnexpectedValueException::class);
+        $this->expectExceptionMessage('Payload iat must be a number');
+
+        $payload = JWT::encode(['iat' => 'not-an-int'], $this->hmacKey->getKeyMaterial(), 'HS256');
+        JWT::decode($payload, $this->hmacKey);
+    }
+
+    public function testDecodeExpectsIntegerNbf()
+    {
+        $this->expectException(UnexpectedValueException::class);
+        $this->expectExceptionMessage('Payload nbf must be a number');
+
+        $payload = JWT::encode(['nbf' => 'not-an-int'], $this->hmacKey->getKeyMaterial(), 'HS256');
+        JWT::decode($payload, $this->hmacKey);
+    }
+
+    public function testDecodeExpectsIntegerExp()
+    {
+        $this->expectException(UnexpectedValueException::class);
+        $this->expectExceptionMessage('Payload exp must be a number');
+
+        $payload = JWT::encode(['exp' => 'not-an-int'], $this->hmacKey->getKeyMaterial(), 'HS256');
+        JWT::decode($payload, $this->hmacKey);
+    }
+
+    public function testRsaKeyLengthValidationThrowsException(): void
+    {
+        $this->expectException(DomainException::class);
+        $this->expectExceptionMessage('Provided key is too short');
+
+        // Generate an RSA key that is smaller than the 2048-bit minimum
+        $shortRsaKey = openssl_pkey_new([
+            'private_key_bits' => 1024,
+            'private_key_type' => OPENSSL_KEYTYPE_RSA,
+        ]);
+
+        self::assertNotFalse($shortRsaKey, 'Failed to generate a short RSA key for testing.');
+        $payload = ['message' => 'abc'];
+        JWT::encode($payload, $shortRsaKey, 'RS256');
+    }
+
+    /** @dataProvider provideHmac */
+    public function testHmacKeyLengthValidationThrowsExceptionEncode(string $alg, int $minLength): void
+    {
+        $this->expectException(DomainException::class);
+        $this->expectExceptionMessage('Provided key is too short');
+
+        $tooShortKeyBytes = str_repeat('b', $minLength - 1);
+        $payload = ['message' => 'abc'];
+
+        JWT::encode($payload, $tooShortKeyBytes, $alg);
+    }
+
+    /** @dataProvider provideHmac */
+    public function testHmacKeyLengthValidationThrowsExceptionDecode(string $alg, int $minLength): void
+    {
+        $this->expectException(DomainException::class);
+        $this->expectExceptionMessage('Provided key is too short');
+
+        $tooShortKeyBytes = str_repeat('b', $minLength - 1);
+        $payload = ['message' => 'abc'];
+
+        $validKeyBytes = str_repeat('b', $minLength);
+        $encoded = JWT::encode($payload, $validKeyBytes, $alg);
+
+        JWT::decode($encoded, new Key($tooShortKeyBytes, $alg));
+    }
+
+    /** @dataProvider provideHmac */
+    public function testHmacKeyLengthValidationPassesWithCorrectLength(string $alg, int $minLength): void
+    {
+        $payload = ['message' => 'test hmac length'];
+
+        // Test with a key that is exactly the required length
+        $minKeyBytes = str_repeat('b', $minLength);
+        $encoded48 = JWT::encode($payload, $minKeyBytes, $alg);
+        $decoded48 = JWT::decode($encoded48, new Key($minKeyBytes, $alg));
+        $this->assertEquals($payload['message'], $decoded48->message);
+
+        // Test with a key that is longer than the required length
+        $largeKeyBytes = str_repeat('c', $minLength * 2); // Longer than min bytes
+        $encoded64 = JWT::encode($payload, $largeKeyBytes, $alg);
+        $decoded64 = JWT::decode($encoded64, new Key($largeKeyBytes, $alg));
+        $this->assertEquals($payload['message'], $decoded64->message);
+    }
+
+    public function provideHmac()
+    {
+        return [
+            ['HS384', 48],
+            ['HS256', 32],
+        ];
+    }
+
+    /** @dataProvider provideEcKeyInvalidLength */
+    public function testEcKeyLengthValidationThrowsExceptionEncode(string $keyFile, string $alg): void
+    {
+        $this->expectException(DomainException::class);
+        $this->expectExceptionMessage('Provided key is too short');
+
+        $tooShortEcKey = file_get_contents(__DIR__ . '/data/' . $keyFile);
+        $payload = ['message' => 'abc'];
+
+        JWT::encode($payload, $tooShortEcKey, $alg);
+    }
+
+    public function testEcKeyLengthValidationThrowsExceptionDecode(): void
+    {
+        $this->expectException(DomainException::class);
+        $this->expectExceptionMessage('Provided key is too short');
+
+        $payload = ['message' => 'abc'];
+
+        $validEcKeyBytes = file_get_contents(__DIR__ . '/data/ecdsa384-private.pem');
+        $encoded = JWT::encode($payload, $validEcKeyBytes, 'ES256');
+
+        $tooShortEcKey = file_get_contents(__DIR__ . '/data/ecdsa192-public.pem');
+        JWT::decode($encoded, new Key($tooShortEcKey, 'ES256'));
+    }
+
+    /** @dataProvider provideEcKey */
+    public function testEcKeyLengthValidationPassesWithCorrectLength(
+        string $privateKeyFile,
+        string $publicKeyFile,
+        string $alg
+    ): void {
+        $payload = ['message' => 'test hmac length'];
+
+        // Test with a key that is the required length
+        $privateKeyBytes = file_get_contents(__DIR__ . '/data/' . $privateKeyFile);
+        $encoded48 = JWT::encode($payload, $privateKeyBytes, $alg);
+
+        $publicKeyBytes = file_get_contents(__DIR__ . '/data/' . $publicKeyFile);
+        $decoded48 = JWT::decode($encoded48, new Key($publicKeyBytes, $alg));
+        $this->assertEquals($payload['message'], $decoded48->message);
+    }
+
+    public function provideEcKeyInvalidLength()
+    {
+        return [
+            ['ecdsa192-private.pem', 'ES256'],
+            ['ecdsa-private.pem', 'ES384'],
+        ];
+    }
+
+    public function provideEcKey()
+    {
+        return [
+            ['ecdsa-private.pem', 'ecdsa-public.pem', 'ES256'],
+            ['ecdsa384-private.pem', 'ecdsa384-public.pem', 'ES384'],
+        ];
+    }
+
+    private function generateHmac256(): Key
+    {
+        return new Key(random_bytes(32), 'HS256');
+    }
 }
diff --git a/tests/data/ecdsa192-private.pem b/tests/data/ecdsa192-private.pem
new file mode 100644
index 00000000..4d9bc0b1
--- /dev/null
+++ b/tests/data/ecdsa192-private.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MF8CAQEEGPRkK7lK/9FuZ3BE8ZX+dlHavL22Q9CN2KAKBggqhkjOPQMBAaE0AzIA
+BL4pM50YcLq/I9Y8T+C+fwoOtwRW8zdV6yQmG9fD8zWaAs28+UxHeK8VD7THatbp
+wg==
+-----END EC PRIVATE KEY-----
\ No newline at end of file
diff --git a/tests/data/ecdsa192-public.pem b/tests/data/ecdsa192-public.pem
new file mode 100644
index 00000000..d4aeee1d
--- /dev/null
+++ b/tests/data/ecdsa192-public.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MEkwEwYHKoZIzj0CAQYIKoZIzj0DAQEDMgAEvikznRhwur8j1jxP4L5/Cg63BFbz
+N1XrJCYb18PzNZoCzbz5TEd4rxUPtMdq1unC
+-----END PUBLIC KEY-----
diff --git a/tests/data/octet-jwkset.json b/tests/data/octet-jwkset.json
new file mode 100644
index 00000000..5555b9dd
--- /dev/null
+++ b/tests/data/octet-jwkset.json
@@ -0,0 +1,22 @@
+{
+    "keys": [
+        {
+            "kty": "oct",
+            "alg": "HS256",
+            "kid": "jwk1",
+            "k": "xUNfVvQ-WdmXB9qp6qK0SrG-yKW4AJqmcSP66Gm2TrE"
+        },
+        {
+            "kty": "oct",
+            "alg": "HS384",
+            "kid": "jwk2",
+            "k": "z7990HoD72QDX9JKqeQc3l7EtXutco72j2YulZMjeakFVDbFGXGDFG4awOF7eu9l"
+        },
+        {
+            "kty": "oct",
+            "alg": "HS512",
+            "kid": "jwk3",
+            "k": "EmYGSDG5W1UjkPIL7LelG-QMVtsXn7bz5lUxBrkqq3kdFEzkLWVGrXKpZxRe7YcApCe0d4s9lXRQtn5Nzaf49w"
+        }
+    ]
+}