to begin with, why not setting validity for 1hr? you don't need to onboard an untrusted tool then.