How does Auth.js handle signing and encrypting

[HenrikZabel]

I am currently trying to understand the library in more detail and am sifting through the code. I've just come across the point where the JWTs are encrypted, but I can't find a point where the JWTs are signed. Are JWTs signed and then encrypted or just encrypted and if the latter - why would you do that; don't you lose some security?