On the negative hand, they are still bearer tokens. On the positive hand, they're valid in exactly one place and valid for 10 minutes and you can actively check their validity with the Kubernetes API Server