I thought this was talking about JWT not restricting by IP specifically because Kerberos does. Kerberos has very stringent requirements to onboard and preregis

I thought this was talking about JWT not restricting by IP specifically because Kerberos does. Kerberos has very stringent requirements to onboard and preregister user devices, that works in limited contexts like desktop or server authentication in an intranet. JWT is intended to cover other use cases like web authentication. Their (non) limitations are simply reflections of their use cases.