jwtSecret should not be mandatory in order to just verify JWTs
In https://github.com/graphile/postgraphile/blob/601a1086a2c10ebae4747364e199f2517d653861/src/postgraphile/http/createPostGraphileHttpRequestHandler.ts#L132, provided JWTs are ignored, if a jwtSecret is missing. However, I would expect, that JWTs would still be taken into account, if one is able to provide a jwtPublicKey – but then, just for verification, of course.