We stopped asking Supabase who you are on every request, and the only thing that got worse is revocation

auth.getUser() is a network call to the Auth server, and our proxy runs on every page request that is not a static asset. Swapping it for local verification against the project's public signing key took one module, and the interesting parts are the cache, the key rotation and the hour we agreed to live with.