Comment 4 for bug 1590805

This is either a legitimate bug, or there's an unfortunate technical limitation requiring keystone to revoke more tokens than strictly necessary in the name of performance vs security.