Shorter than you are comfortable with, because expiry is currently doing the work revocation cannot. Until cross-organization revocation propagates, a cached assertion stays valid until it expires — which makes the expiry your real blast-radius control rather than a hygiene setting.