Authenticating to cloud function from PubSub push subscription

We are using PubSub for queuing utilizing a push subscription pointing at an http-triggered cloud function. According to this documentation Cloud Run and App Engine will both authenticate requests from PubSub, cloud functions isn’t listed. We have used other google services, like scheduler to invoke functions which require authentication, but have not had luck doing so with PubSub.

My question is, does cloud functions support authentication from PubSub through a subscription aim account set, or is it required that the function read and deal with the JWT itself for authentication?