send the jwt-signed plaintext version of the request so that we know which key to expect is signing the challenge