SameSite cookies are here to stay.
They were available for a long time in Chrome (since v51) and more recently got implemented in Firefox.
Making cookies samesite protect against a whole range of CSRF vulnerabilities. It protects against BREACH, a compression side channel attack that can steal a cookie by forging a lot of authenticated requests. It protects against some client-side Spectre attacks, where the response to a cross-origin request is read using speculative execution vulnerabilties.
The spec is still being worked on. For example, how strict samesite cookies should behave in redirects is not entirely clear.
I would currently advise everybody to set samesite=Lax on all cookies. It offers a reasonable security advantage without breaking things or being too much work. Using samesite=Strict cookies gives more security, but may break some functions on your site.
Server software needs to give the option to set the samesite attribute to either
Strict. That part of the spec is very stable and it would not be premature to offer that. For example, PHP is planning to add samesite to their setcookie function.
Also, I would expect that you could use samesite cookies even if Tomcat doesn't implement it, if you create your own Set-Cookie headers.
Update: Chrome is planning to make all cookies SameSite=Lax by default, which you can disable by setting SameSite=None.