> A typical architecture might have a timestamp stored per user that specifies the earliest token creation date that’s valid for refresh.

Never worked with JWTs but still, can't believe I didn't think of this. It seems like a fairly elegant way to revoke things where your only stored state is a timestamp.