I wish that for OAuth 3 they would make it such that client and server can separately sign the request and you don't have to share keys between the two. That would be a great security enhancement.