Haven't heard of PASETO, but I'll check it out. I'd say JOSE is an implementation detail of what I'm advocating for, so very open to alternatives.
PASETO is the “mostly fixed” version of JWTs, but if you’re looking for something with more features, biscuits are quite interesting: