[pan69]

But if the jwt was leaked before the client forgot it, the jwt itself is still valid and can continued to be used by an attacker.

[stkdump]

I wonder if an extension to the concept of jwt that extends the cryptographics chain down into some hardware component such as a TPM or secure enclave is the right answer. Basically the payload of the token could contain a pubkey for checking a signature on the request payload. The logout button would then have two local effects on the client side: delete the token and tell the hardware component to forget the private key.