Good question, how does one verify the response of a JSON API? Always thought digital certificates are enough to verify the sender.
shkspr.mobi/blog/2020/01/w…