I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public key tied to the user.
As REST/HTTP is touch and go I cannot hold an authentication session similar to the way that SSH does it. For this reason I am considering the client simply sending their user ID (without any prior authentication) and the server replies with a JSON web token encrypted with the user's public key (from server database). Anyone can request an encrypted JSON web token tied to any user, but in theory only the user who holds the private key can decrypt and use it.
What are the potential risks and implications of using this method?