Empty string accepted as HMAC secret key without warning

Description

python-jose accepts an empty string `""` as an HMAC secret key, produces a valid token, and decodes it successfully — with no warning or error. An empty HMAC key provides no cryptographic protection.

Reproduction

from jose import jwt
token = jwt.encode({"sub": "test"}, "", algorithm="HS256")
result = jwt.decode(token, "", algorithms=["HS256"])
# Returns: {"sub": "test"} — no error