Do you mean "delete the cookie" with "expiring it"? Then that doesn't help against an attacker which already has obtained the JWT, they can still use the JWT until it's expiry.
2) logout = request to server, server sets cookie with "token=empty;expires:1970yaddayadda" as it's httpOnly there's no client-side messing baout with the cookie otherwise
3)_all pages send cookie with each request, so must be tls
upon logout, cookie has empty token, must be re-set with new token. old token, if stolen, can be compared with logged history, etc.
what do you see, in terms of flaws?