A naked credential (just the JSON) cannot be verified that it isn't revoked. Potential solution: update the credential with a custom DID field so it can be checked for revocation.