Curious if there is an advantage to the JWT being signed when forwarding oathkeeper requests using the id token mutator? If the target service is internal (and only available behind oathkeeper), validating the signature isn't so important right? I guess it's important if the service is also available via other paths that don't go through oathkeeper?

if you're certain your networking only allows traffic from oathkeeper, you're right it's probably redundant. however, in keeping in line with the zero-trust approach, it's probably still a good backup to have just in case, and it should be negligible to performance