In the SAML and Kerberos authentication models, there is an explicit understanding of what authority has authenticated the user and issued the credential to be trusted by downstream systems. For purposes of identity propagation, the rights of the downstream system to impersonate the user can be tightly controlled within the solution architecture and the associated identity domains.
As far as I can tell, the completeness of the SAML and Kerberos models is not part of the JWT approach. JWT appears to be a mechanism that provides functionality quite similar to Kerberos, but without the supporting functionality of a defined KDE.
Am I missing something? Is JWT based on a "web of trust" or is each JWT implementation responsible for defining its own trustable authentication mechanism and so on?