Most SSO runs on SAML, which uses XML Signature, which uses PKI certificate chains without TLS. Even if you think all SSO will migrate to OIDC, the EU has enac

Most SSO runs on SAML, which uses XML Signature, which uses PKI certificate chains without TLS. Even if you think all SSO will migrate to OIDC, the EU has enacted laws around electronic signatures that basically enshrine the use of XML Signature (with all its problems) for the foreseeable future. A lot of countries beyond the EU (many LatAm countries, for example) have followed suit. There are other signature protocols that use certificate chains as well, and devices and networks that should not be making network calls when validating such signatures. And as I mentioned, TLS uses are not limited to those where revocation information is readily accessible.