They let you answer the question "did some other machine I trust find this entity to be a valid user, having this identity and the rights they assert they have?

They let you answer the question "did some other machine I trust find this entity to be a valid user, having this identity and the rights they assert they have?" without asking that machine directly or storing anything about the user. More or less. Provided the keys haven't leaked, of course. The chief difficulty this introduces is manually invalidating tokens. You end up having to store some data and/or ask some other system questions about users (blacklist-related, in either case) after all, reducing the initial benefit. But distributed sessions will run into similar problems anyway. Basically if your auth lives the same place as all parts of your application the user will ever see, don't bother with it because the benefit is little to none, otherwise, JWT's a solid maybe.