I think it really depends... I don't know that there is a perfect strategy here, but even reducing to a 5-minute token with refresh, I'm not sure the 5 minute window is that bad. And if it is, there are more serious issues at play.

One of the advantages of JWT, especially with public/private key signing is that you can verify a token without a potentially long network/service request or lookup adding latency to every API request. And if one API passes down to internal APIs it's even more of an impact.

In the end, pick your poison, but if you want to expire them, may as well generate an identifier as a token/cookie and lookup against Redis, or another session database/table for the identifier itself. Having the data in the payload doesn't do much good if you're validating against another service for every request anyway. If you want broader replication Cassandra or a similar database with nodes for replication near each server could help mitigate things, again no need to include the JWT payload in the token at that point though.

Using hooks to propagate revocations is almost worse, because it's fragile and may see misses in practice.