RFC 7519 specifies an optional "iat" field, indicating when a token was issued. The RFC provides a terse commentary:
This claim can be used to determine the age of the JWT.
What is the purpose of the "iat" field? For example, why would one want to determine the age of a JWT? Were there specific purposes in mind when the spec was created?
Edit: Notably, x509 does not have an analogous field, though it may frequently be that
Not Before is very close to "Issued At." Another way of phrasing this question is: Why does JWT deliberately distinguish "Issued At" vs. "Not Before?"