Why is it hard to revoke a single JWT before it expires?

Because JWT validation is designed to be stateless and local — a resource server checks the signature and expiry without any server-side lookup, so there's no central place to 'delete' one specific token. Mitigations include keeping access tokens short-lived, maintaining a deny-list of explicitly revoked token IDs (jti claim) that resource servers check, or falling back to shorter-lived opaque tokens for highly sensitive operations.