Tampered body doesn't brake the verification about web3-token

[herzog0]

I've downloaded your code and searched a bit, and I've come to the conclusion that tampering can't be detected solely looking at the combo signature+message, the expect public key has to be there too for a true verification, right?
The problem in my case is that I don't have the user's public key prior to their signing up in my platform. I wonder however if a little trick could be done so that it is almost impossible for someone to be tampering the message, which is to generate two tokens instead of one in the browser, each token having a different signature+message pair.
This way, in the backend, I can check that the public addresses recovered from the tokens are the same, therefore those tokens MUST have been generated by the same private key and, therefore, the likelihood of the bodies having been tampered is almost zero.
Do you think this is a good approach?

[dvartic]

I think in the current implementation you should check address against expected address to avoid any potential unwanted behaviour.