It's almost a shame it includes the private key and doesn't bruteforce it in-band for every request.

They have the supporting code for using a key, I'm assuming they don't have in band bruteforce since it doesn't usually make any sense at all

I wonder if more CPU cycles would be spent in the transporting and other ancillary operations (hashing and signing) than would be spent if they "brute-forced" it. Crazy.

OMG, that would be brutal

I would've at least appreciated once per session