It makes a pretty big difference whether you have to send the secret down the wire to prove you possess it (e.g. a JWT, unlike say a private key).