Bob,
I'm not sure I understand why you say that JCS requires *almost* full normalization.  Using browsers you can generate fully compliant JCS objects using like 20 lines of javascript/webcrypto (here excluding base64 support).  No normalization step is needed.

But sure, the IETF JOSE WG has taken an entirely different approach and require JSON objects to be serialized and Base64-encoded.  Then the Base64 is signed.  Boring.  And in conflict with complex messaging like:
https://openkeystore.googlecode.com/svn/wcpp-payment-demo/trunk/docs/messages.html#UserAuthorizesTransaction

Thanx anyway, I'm pretty happy with how it works now!

Well, if Decimal didn't manipulate its argument I would be even happier :-) because then there wouldn't even be a hack.