The one approach you missed on that blog post: put an envelope inside an envelope. Does anyone ever do this?

  {
    "original":"json",
    "goes":"here"
  }

Signed:

  {
  
  "original_json_contents_base64":"ewogICJvcmlnaW5hbCI6Impzb24iLAogICJnb2VzIjoiaGVyZSIKfQo=",

  
  "hmac_sha256_of_base64":"bf1f4cb95ce8633aff46888e1717873e32bb2a770b3d4b5b74a59e5e9adefeda"

  }

This way you have full control over the raw bytes you want to sign (by forcing them into Base64 where other systems can't get their dirty paws on them).

I guess the problem here is if intermediate systems want to do stuff based on the payload (but without validating it), they won't like this.

But if the problem is just intermediate systems barfing on non-json, this might work!

p.s. enjoyable blog post - as they always are! ;-)