The JWT is only refreshed if a client calls into the SDK (more precisely, on http requests to OVC). If the time between two consecutive calls from a client exceeds the JWT's refresh period, refreshing it will of course fail.
Idea: periodically refresh it in the background - requires the introduction of a means to terminate that background task (Close method?)?