But they don't need to have a realtime revocation list -- it's fine if a broken card works until the end of the day, or even the end of the week, as long as it stops working faster than keys are leaked or cracked.

So a bus turnstile can do transactions when it returns to the garage, and turnstiles in locations where it's hard to run data for whatever reason can get a plug-in every so often on a regular maintenance run.