I'd be tempted to add a grace period here, so that clock skew doesn't cause us to delete tokens that are actually still valid.  IIRC the sync ttl-expiration scripts use one day of grace, i.e. "delete tokens that have been expired for more than a day".  It's low cost and might avoid a bit of jank in some edge-cases.