Changing JWTs to RS256 to verify JWT inside getSession() anywhere

Hi, right now the supabase JWTs use HS256 for encryption. This means that in order to verify the JWT fully we need the JWT secret, which in turn means that the best way to verify the JWT right now is to query supabase.auth.getUser() which retrieves the user from the auth backend while checking the JWT is ok. getSession() does (as the discussions around the warnings it can generate in connection with SSR) NOT verify the JWT. Therefore the JWT payload could be modified, without changing the JWT signature and you would never know. Having to run supabase.auth.getUser() on every server request or possibly more often is however not very cost-effective and takes time. Is the best solution not to change Supabase's JWT to RS256 or RS512, which would result in a private key to generate the signature but a public key to verify it! This would mean it would be totally ok to release the public key even inside the client facing code, allowing both server and client to use getSession() …