Question: why does the nonce staticmethod add angle brackets around the nonce value?

[jrobbins-LiveData]

https://github.com/cak/secure/blob/04dd035e560583baeba06f5714f273b542c07767/secure/headers.py#L452

The examples of adding a nonce to CSP that I've seen in, e.g., https://csp.withgoogle.com/docs/strict-csp.html#example and https://content-security-policy.com/nonce/ show 'nonce-rAnd0m'.

The CSP3 spec specifies the nonce production as:

; Nonces: 'nonce-[nonce goes here]'
nonce-source  = "'nonce-" [base64-value](https://www.w3.org/TR/CSP3/#grammardef-base64-value) "'"
base64-value  = 1*( [ALPHA](https://tools.ietf.org/html/rfc5234#appendix-B.1) / [DIGIT](https://tools.ietf.org/html/rfc5234#appendix-B.1) / "+" / "/" / "-" / "_" )*2( "=" )

Are the characters < and > even allowed?

[cak]

Thank you @jrobbins-LiveData!