-T + -X k not tampered

[EParisot]

When using both -T an -X k options, the resulting JWT does takes the new data into account, so the -T does nothing