That's only true if you do not allow for long running sessions which are commonplace today. And it still requires a lookup every time to see if a particular session is blacklisted.

From what I could grasp there's no mechanics for blacklists/revocations in the current implementation of this service.