Hacker News Reader

Exactly. JWTs can't be extended since the signature is part of the JWT and signs the JSON body, where the expiration is.

I'd think "extension" in this case means "hand in a jwt with expiration/renewal fields still valid, get a new jwt with extended expiration".

Obviously the renewal service would need to be able to sign the new/extended token.