Integrating ChirpStack into our Application

Hello everyone,
we wan’t to integrate ChirpStack into our application via the mqtt integration (we already have integrations to other lorawan servers like ttn and loriot).
The challenging part is that our application can be installed as a SaaS Solution (with multiple users and companies) or as an on premise solution, and we want to give our customers the choice to install and run there own ChirpStack instance or use an global instance administered by us.
We would prefer to use jwt as an authentication mechanism (we tested mosquitto with the mosquitto-go-auth plugin). What would you recommend we use to create the jwts? Generating those ourself seems not to be a good idea as in the user provided instance we probably don’t have access to the secret and in the later case we would have to extend ChirpStack to display the jwt for the user (so he can copy it into our application).