jwt.verify() not truly async.

Despite the verify action is in fact synchronize, the callback API does not.

It is specifically this line that released Zalgo.

https://github.com/auth0/node-jsonwebtoken/blob/5a7fa23c0b4ac6c25304dab8767ef840b43a0eca/verify.js#L24

Which can be fixed by wrapping it as such

    done = function(err, data) {
      setImmediate(callback, err, data);
    };

[vicary]

Forgive my words if the opinion is too strong, but to the best of my knowledge the consensus is already there for decades.

The nature of an asynchronous API should behave like it means, implementation should be hidden behind the API even if it is a so-called lie.

The API is the contract of behavior between the library and its users, and should be followed the moment it goes public as (Asynchronous) ….

IMO #302 should in fact use the (Synchronous) … version without callback for the desired performance gain, and such performance differences should be documented instead of breaking the API.

[mcmar]

We might be able to use something like threads.js to do this in a real multi-threaded manner, which would be fun and sexy for everyone. But it also might reduce compatibility and/or require pseudo-polyfills like webworker-fallback