The comparison table makes the cross-service mismatch clear. One distinction worth adding: reducing clock skew tightens expiry enforcement, but it doesn't revoke a token before its expiry. Immediate logout or incident response still needs a separate revocation strategy. I'd add boundary tests around both exp and nbf, with the chosen leeway, so a configuration change doesn't silently accept tokens early or reject valid ones across services.