@soatok Awesome, thanks for the reference! Love your blog btw. As a new reader, I haven't seen a lot of the older posts yet, like this one.
I totally agree with you how lots of agility is bad here. I'd say my approach is pretty darn close to your section called "Versioned Protocols". I try to strike a balance here so I can actually have a defined migration path while not allowing dumb things like `alg = none`. All the primitive choices and parameters are hard-coded. The only data-defined choice is a single version number. It feels like a good spot on that tradeoff spectrum.