I looked through the code again to check and this error can also occur if you don't have a JWT submitted for authentication as well.
What version of which tunneler is this?
I think it would be useful to try using the ziti ops verify ext-jwt-signer like I showed in this post? Problem with importing network.jwt or using the URL method - #2 by TheLumberjack
Let's make sure you can authenticate using the ziti CLI first and then let's try to diagnose the tunneler issue. This ziti CLI command will hopefully prove that your signer is setup and your controller so that we can leave the tunneler out of this equation for now.
Once you can verify the ext-jwt-signer with the cli, let's try to diagnose the tunneler (if necessary).