update readme and bump version to v0.3.41.2

The JOSE and JWT specs are now RFCs so update some commentary and
references.  Also bump version to release the GHC 7.10 compat fixes.

README.md

@@ -2,11 +2,13 @@
 
 jose is a Haskell implementation of [Javascript Object Signing and
 Encryption](https://datatracker.ietf.org/wg/jose/) and [JSON Web
-Token]
-(https://datatracker.ietf.org/doc/draft-ietf-oauth-json-web-token/).
+Token](https://tools.ietf.org/html/rfc7519).
 
 Encryption (JWE) is not supported but signing is supported.  All key
 types and algorithms are supported, but EC and symmetric key
 generation is not yet implemented.
 
+EC signing is currently vulnerable to timing attacks therefore its
+use is **strongly discouraged**.  (EC validation is safe).
+
 Contributions are welcome.

jose.cabal

@@ -1,13 +1,14 @@
 name:                jose
-version:             0.3.41.1
+version:             0.3.41.2
 synopsis:
   Javascript Object Signing and Encryption and JSON Web Token library
 description:
   .
   An implementation of the Javascript Object Signing and Encryption
-  (JOSE) and JSON Web Token (JWT) formats.
+  (JOSE) and JSON Web Token (JWT; RFC 5717) formats.
   .
-  Web Encryption (JWE) is not yet implemented.
+  The JSON Web Signature (JWS; RFC 5715) implementation is complete.
+  JSON Web Encryption (JWE; RFC 5716) is not yet implemented.
   .
   All JWS algorithms (HMAC, ECDSA, RSASSA-PKCS-v1_5 and RSASSA-PSS)
   are implemented, however, the ECDSA implementation is is
@@ -18,10 +19,6 @@ description:
   Mozilla Persona (formerly BrowserID) key format.  Only RSA keys
   are supported - DSA keys cannot be used and must be handled as
   opaque objects.
-  .
-  The version number tracks the IETF jose working group draft
-  revisions.  For now, expect breaking API changes on any version
-  change except for the final (fourth) part being incremented.
 
 homepage:            https://github.com/frasertweedale/hs-jose
 bug-reports:         https://github.com/frasertweedale/hs-jose/issues