A token containing the hash of a public key -- isn't that just a certificate? Why is it better to embed it in a token instead of just issuing the client a certificate? They both provide exactly the same security guarantees, and as you point out the ecosystem support for either is poor, so new development needs to happen either way.