I ran into an issue when developing where a user that did not exist, but had a correctly signed JWT, was logged in.
This happened when I absentmindedly logged in using a browser while running the test server. Because I used the same makeshift credentials for the user in both databases, the login succeeded. I then switched back to the development server which caused various problems.
In the end, I added a check that the user existed and a unit test that non-existing, but correctly signed, users are rejected. But in production, the leak of my secret would be a catastrophic failure in itself that should never happen. I was already rejecting incorrectly signed tokens. Does having a check like this make sense, or does it just add needless complexity?