I actually think the revocation argument is the over-engineering case here. I'd argue that people who need to avoid hitting their database on every request out

I actually think the revocation argument is the over-engineering case here. I'd argue that people who need to avoid hitting their database on every request outnumber people who need sub-minute revocation