[withinboredom]

Right, but there’s no way to do that on the same day every year, or even the “first Tuesday of every June” because that may or may not always fall within a year.

Also, these tokens have to be rotated by a human. So weekly is way too often.

[insanitybit]

> Right, but there’s no way to do that on the same day every year, or even the “first Tuesday of every June” because that may or may not always fall within a year.

Why would that matter?

[withinboredom]

Because we are humans. If I say “see you in a year” that doesn’t mean a year to the second.

[insanitybit]

I don't understand the problem here. You can have a separate revocation schedule.

[withinboredom]

If you don’t understand it, you must not work with a lot of humans doing human things. Ask a bunch of friends that don’t work with computers what today, plus one year is. You’ll hear everything from “365 days” to today’s date next year to 365.25 days. At no point do you hear the current time, on this date.

So if lots of things go wrong that you are having to rotate this in a year, you are doomed to fail because there’s also a time stamp on it. There’s no grace period, so things will break.

If there’s a revocation system, there’s no reason for a hard expiration of the token is still being used.

[insanitybit]

A grace period would not solve anything. If it were "one year and one day" you'd have the same exact problem.

Revocation and expiration are virtually the same thing.

[withinboredom]

> If it were "one year and one day" you'd have the same exact problem.

No, it would not, at all. Think of it like this: if I ask you to put something on your calendar one year from now, what kind of calendar event would it be? It would probably be an "all day event" and you wouldn't even to think to ask "what time?"

> Revocation and expiration are virtually the same thing.

Revocation is an intentional act done by humans. Expiration happens simply by the passage of time in relation to the movement of Earth around the sun.