The signed exchanges protocol requires that the content be signed with a key with a short expiry date (< 1 week), sites are free to make it shorter. In extreme cases, the providing site could sign with an expiry of < 1 day or even something like 1 hour.

And iiuc, sites are still free to revoke their certs. So this is actually probably more secure compared to something like https in that regard.

[0]: https://github.com/WICG/webpackage/blob/6cc3237b36c2f9ce7534...