My custom web server software uses a 'server identity' which is a public/private bitcoin keypair. It's for extremely limited resource environments ie..IOT, which is why I don't use a common stack with OAuth etc..
I use the private key to sign certain messages I send to the app clients, so they can verify authenticity. The server is very much stateless, I don't wish to store any more data that I need to (auth tokens).
Are there implications to just signing a message, sending it to client as token, which they will send back in the authorization header with an expire timestamp? I will verify on the server. Not storing any tokens.