Are cookies actually being signed?

Using the example code in your readme, I can't find any trace of the `app.keys` `'some secret hurr'` actually being used to sign the cookie.

I assumed it would be used to generate the `koa:sess.sig` cookie, but it looks like that's generated by simply stringifying the session's contents and running it through crc32 - A process that a malicious user could easily replicate after modifying the contents of the `koa:sess` cookie.

What am I missing?

Begin with the README example and trace how app.keys, koa:sess, and koa:sess.sig are handled, then inspect the crc32 path described in the report. Done means establishing whether the secret is used for signing and recording the expected secure behavior with a regression check.

Written by the indexing model from the issue text.