I understand your logic, but the thing is: nobody implements dsig; they pretty all depend on a single dsig implementation (libxmlsec1). Writing a dsig implementation is obnoxious.

That's not true of JWT; people definitely do implement their own JWT.

They're both awful protocols, and for a lot of the same reasons.