Not super-opinionated on this, but let me try to steelman the JWT case. Yes, to perform session invalidation with JWT requires some amount of centralized state

Not super-opinionated on this, but let me try to steelman the JWT case. Yes, to perform session invalidation with JWT requires some amount of centralized state, so a perfectly-decentralized auth system is not actually possible. However, using JWT means this centralized state is much less heavy than traditional sessions. Instead of saving ALL sessions and ALL session data on the server, JWT only requires saving a small fraction of session ids (those that have been recently invalidated) and NO session data. By using JWT, you have simplified your memory needs and reduced them by multiple orders of magnitude.