Not checking the signature on every single JWT is the same as storing a password in plain text.

worse, it's storing identities in an editable format that any attacker can use to impersonate any user, no?