Just one major remark: opaque token handling was absolutely not a "leftover", so I'm not sure why you would remove it ... Ideally, tokens are opaque and only the AS knows their meaning. Transmitting the related info in a JWT is handy for development, but is less secure, and should probably not be used in a production environment.

I don't fully remember any more, but I think I removed it based on the comments that were there and that I didn't see it used, with the idea that it can be added back once it was actually used. But I can have another look into how much of it can be salvaged already.