>yeah, I always wondered why there isn't a standard field in the JWT containing a fingerprint/hash of the client's machine/browser/etc.

Good that you brought it up. That's why I still bake my own verification session system.