This is really nice way of putting this. Logging in/out is authorization (and authn) so generally if you want to revoke access (log people out), JWTs are possibly the wrong choice (the thing people use JWTs for 99% of the time)