It's really silly that this was the only means of blocking access. I expected them to have, I don't know, some sort of cryptographic signature or something.

An additional JWT with a long expiry time would even work here, anything.