10-20 is fantastic in comparison. Even if people don't have more than one it at least reduces the blast radius..
But it's a trade off. Long-lived TLS certificates have always had the cert revocation problem. OCSP stapling never took off, so in the end the consensus seems to have been to decrease expiry date. (Mostly fueled by Let's Encrypt / ACME).
Relying on expiration rather than explicit revocation of course also assumes (somewhat) accurately synchronized clocks which is never trivial in distributed systems. In practice it put's pressure on NTP, which itself is susceptible to all kinds of hairy security issue.
I like to think of the temporal aspect as a fail-open / fail-close balance. These centralized solutions favour the former, and that's why we see this resulting outage.
In fact, we don't have real time revocation of any document until very recently...
You should still be able to authenticate with each individual service when the centralised service is down.
There is no reason why you shouldn't be able to login to your bank under these circumstances.