I think an easy way to think about them is it's just a json object, with some cryptographic crud glued to it that proves who created it.