Maybe I'm missing something obvious, but I tried your library and it is still vulnerable to type confusion when using multiple allowed algorithms (i.e. your first example in https://github.com/firebase/php-jwt/issues/351).

Furthermore your JWT::encode function has two problems:

• Encode does not work when you supply a keyring (keyId check is wrong)
• PHPDoc parameters are wrong for $key, $keyId and $head

Consider this test case:

<?php

use ParagonIE\PhpJwtGuard\JWT;
use ParagonIE\PhpJwtGuard\KeyRing;
use PHPUnit\Framework\TestCase;

class JWTTest extends TestCase
{
    public function testConfusion(): void
    {
        $hsKey = hash('sha256', 'phpunit-test-key-for-issue-351');

        $esPubkey = <<<END
            -----BEGIN PUBLIC KEY-----
            MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEEVs/o5+uQbTjL3chynL4wXgUg2R9
            q9UU8I5mEovUf86QZ7kOBIjJwqnzD1omageEHWwHdBO6B+dFabmdT9POxg==
            -----END PUBLIC KEY-----
            END;

        $keyring = new KeyRing();
        $keyring->with('HS256', 'foo', $hsKey);
        $keyring->with('ES256', 'bar', $esPubkey);

        $payload = ['sub' => 'phpunit'];
        $token = JWT::encode($payload, $esPubkey, 'HS256', 'bar'); // wrong algo

        $fail = false;
        try {
            JWT::decode($token, $keyring, ['HS256', 'ES256']);
            $fail = true;
        } catch (UnexpectedValueException $ex) {
        }
        $this->assertFalse($fail, 'Expected an exception');
    }

    public function testEncode(): void
    {
        $keyring = new KeyRing();
        $keyring->with('HS256', 'foo', hash('sha256', 'phpunit-test-key-for-issue-351'));

        $payload = ['sub' => 'phpunit'];
        JWT::encode($payload, $keyring, 'HS256', 'foo'); // should not throw exception
    }
}