That seems like a good idea. The question is how the JWT is generated. A standard one would be more akin to a traditional crypto keypair. That is a "signal" key insomuch as it tells us who controls an account. It can't tell us the owner is the controller and that is the current weakness of crypto right now. To know the owner, we need another type of keypair to go alongside the traditional kind. That would be a "tone key" and is generated by a refreshing seed derived from the entropy of long-running, unfakeable conversations. The same way a friend might recognize us as being ourselves.
But you don't need to prove to all others that you are yourself, do you? You are only asked whether you're 18, the bouncer doesn't care about your name. So you can still hold the phone (like last summer the ID) of someone else and fake their answer.
