Key management is a critical part of any security system. In the first arrangement. You must establish an appropriate trust model where you know who the authority is and how you trust them. There are multiple issues with the scenario you've presented:
- The client is signing the JWT--how do we trust the client?
- We are sending keys over a medium with no means of verifying certificates
- Trust can only occur if you know the client and the server--that can only happen over encrypted communications
GPG (and PGP) require secure communications when sharing public keys, but the identity of the public key is known. That's the only reason why the point to point communications can be trusted. That's not the way web sites are supposed to work. If you wanted the identity to come from the client, then implement a true PKI implementation. As long as the key is properly signed by one of your trust keys, it is good.
Instead, for web applications, you must implement the authority service that validates the user's credentials--usually requiring encrypted communications so passwords or other tokens cannot be sniffed.
- Once the user's identity is confirmed, the authority generates the JWT with a key your system manages.
- The public key is shared to all backend services as a matter of deployment and configuration--i.e. no need to send the key over any means
With this model, you know the public key and the authority of the private key.
There are more advanced approaches where you are sharing a group of public keys to handle rotating keys. This is more secure, but again, you cannot trust unencrypted communications due to the man-in-the-middle attack possibility.