There is no way to revoke a JWT. However Roundup raises a LoginError if a JWT with an
invalid role is specified.

Could you define per user roles:

  email_read:user21
  email_read:user22

and change the schema to remove those roles and restart Roundup to invalidate
a JWT? So if user22's JWT using email_read:user22 is exposed, change the role to:
email_read:user22_1 and restart roundup. The old JWT will raise a LoginError.
Now every JWT with that role will be obsolete. But the scope of JWT is limited
to that user's JWT.

This does lead to a proliferation of roles and I am not sure what the implications
of that are.