[Mercure] Explain if Caddy's publisher_jwt and subscriber_jwt should be the same or different

[ThomasLandauer]

Ping @dunglas
Mercure's Caddyfile contains two keys: publisher_jwt and subscriber_jwt (by default populated through the environment variables $MERCURE_PUBLISHER_JWT_KEY and $MERCURE_SUBSCRIBER_JWT_KEY).
But the bundles's config/packages/mercure.yaml contains only one secret.
How does this fit together? Are people supposed to use the same string for both keys in the Caddyfile?

• If yes, then why do two settings exist? And isn't this a security risk (kindof allowing subscribers to publish)?
• If no, then how to pass the two strings to the bundle?