One way to look at it is, presumably you will have far fewer revocations than active sessions, so why optimize for that case? Instead of an "active sessions" t

One way to look at it is, presumably you will have far fewer revocations than active sessions, so why optimize for that case? Instead of an "active sessions" table you could just maintain a list of revoked sessions and check each incoming request against that list. You can make revocations expire shortly after the JWT was set to expire.