Either on the wire only, or via oxen client exe too: new operation "check-bearer-token" would yield: ``` { is_valid: true, days_to_forced_rotation: 123 } ``` I don't think a "decode" back to `user` would be good security.