I actually think the revocation argument is the over-engineering case here.

I'd argue that people who need to avoid hitting their database on every request outnumber people who need sub-minute revocation