> Since JWTs can't handle revocation [...] Revocation is just hard. Even PKI's CRLs/OCSP don't have a subscription mechanism by which an end-point can get rev

> Since JWTs can't handle revocation [...] Revocation is just hard. Even PKI's CRLs/OCSP don't have a subscription mechanism by which an end-point can get revocations of some small set of certificates. Even a public feed of revocations could be problematic if you're going to terminate employees because the timing has to be perfect: too early and you're tipping off employees, too late and you're allowing disgruntled employees run malware on your systems and network. In practice being late to revoke access is generally accepted as acceptable as long as it's not too late.