I'm skeptical of there being any security implications. Signed but not encrypted tokens are effectively plaintext metadata, and token revocation is still an imp

I'm skeptical of there being any security implications. Signed but not encrypted tokens are effectively plaintext metadata, and token revocation is still an important operation on the service side, preventing zombie token attacks. Reading metadata can be useful to know when a token is expired without hitting a remote service.