Hacker News Reader

Most systems use this method but over two tokens, usually referred to as a session/access token and a refresh token. See OAUTH.

Exactly. JWTs can't be extended since the signature is part of the JWT and signs the JSON body, where the expiration is.

I'd think "extension" in this case means "hand in a jwt with expiration/renewal fields still valid, get a new jwt with extended expiration".

Obviously the renewal service would need to be able to sign the new/extended token.