> Revocation is essentially the Achilles heel of JWTs

By the nature of the problem you have to store some kind of a list of tokens. Either a black list as with JWTs or a white list as with classic session tokens. There is no way around it. This makes both approaches practically the same.

One can argue that the black list will in general be shorter than the white list, but in a case of a serious attack, would it really be so?

I am afraid that the community will now abandon JWTs and move to biscuits, macaroons, buns and meringues as they did with classic session tokens, throwing away the tools and security practices.