A token is version.purpose.payload with an optional .footer, for example v4.public.…. Each version fixes its cryptography: v3 uses NIST algorithms (ECDSA P-384 for public tokens; AES-256-CTR with HMAC-SHA384 for local ones), v4 uses Ed25519 and XChaCha20 plus BLAKE2b-MAC. Pre-authentication encoding (PAE) binds the header, payload, footer and optional implicit assertions (context that is authenticated but not transmitted, such as a tenant id) into what is signed or MACed.
There is no alg header to abuse and no none; the version and purpose prefixes also stop a local key from being used for public tokens. Keys are serialized with PASERK (k4.public…, k4.local…). Payloads use JWT-style registered claims (exp, iss, aud as ISO 8601 or plain strings).
PASETO is not an IETF standard (the specification lives at github.com/paseto-standard/paseto-spec), and libraries, tooling and identity-provider support are thinner than for JWT. A JWT verified with a pinned algorithm per RFC 8725 gives most of the same safety. The PASETO decoder parses tokens locally.