Comment by phire

You need to support revocation, so I'm not sure it's ever possible to avoid the need for a round trip to verify the token.