Should the Clock class, and JWTVerifier#build method be public instead of package private? Making these package private doesn't do me any good if I want to use a custom clock for unit testing.