For all the complexity of OAuth, an OAuth token is essentially a free pass for $stuff.

Perhaps we could start validating that a token not only is valid, but also is digitally, freshly signed with a known certificate?

I'd say there's a huge difference between:

* I stole a token

* I stole the token AND am able to keep signing said token with my victim's public certificate

A token can be stolen from many places and is comparatively easy to obtain, while full intrusion into an org's infrastructure is less likely, and even if it happens, eventually will be remediated (and the related certificate will be revoked).

Edit: looks like https://tools.ietf.org/id/draft-ietf-oauth-mtls-09.html would fit the bill.