Basically, the client signs the shared key obtained through Diffie-Hellman key exchange, which then gets verified by the server. This ensures that the client and the server have the same shared key, hence no man-in-the-middle.
As a former physicist with a PhD in experimental condensed matter physics, I would say that this is one of the dumbest things I have ever seen. I suspect COVID-19 made people collectively dumber.
You should not use JWT if you have a single application in your organization. However, whenever you have multiple applications, you need some form of central authentication / authorization service. Otherwise, you would have to maintain auth databases in each application, each application will need to be logged-in separately, you won't be able to implement a simple "suspend a user's accounts after X unsuccessful auth attempt", you won't have a central auth log.
Comparing background radiation to exposure from artificial radiation sources does not sound right to me. The background radiation is absorbed relatively evenly by the body surface. However, various artificial radiation exposure is local, such as dental x-rays or CT, which, for example, will increase the thyroid cancer risk at seemingly small exposure levels compared to cosmic radiation exposure.