IIRC we used a small (fixed) window as you're access to a piece of content can be revoked at any given time.
Having a small window means we only leak the (cached) preview images for a couple more minutes rather than 30 days.

One of the suggestions @nicolaasmatthijs just made was to include the user his userId in the signature to prevent a user passing the links around which is something we should probably do for both content and principals