终于通过非标准的做法实现了。

（一）

服务端（基于 OpenIddict 实现的 OpenID Provider）在用户登出时 revoke 当前用户的所有 token

public bool RevokeToken(string subject)
{
    var result = _dbContext.Set<OpenIddictEntityFrameworkCoreToken>()
        .Where(t => t.Subject == subject && (t.Status == Statuses.Redeemed || t.Status == Statuses.Valid))
        .Update(t => new OpenIddictEntityFrameworkCoreToken { Status = Statuses.Revoked });

    return result > 0;
}

Sign-out endpoint 的实现

[HttpPost("/signout")]
public async Task<IActionResult> SignOut(string returnUrl)
{
    var userId = User.UCenter()?.UserId;
    if (userId.HasValue)
    {
        _openIddictService.RevokeToken(userId.ToString());
    }

    await HttpContext.SignOut();
    return Redirect(Url.SecuringUrl(returnUrl));
}

同时，服务端实现一个 web api 用于检查 toke id 对应的 token 是否失效

[HttpHead("validate-token-id")]
public async Task<IActionResult> ValidateTokenId()
{
    if (Request.Headers.TryGetValue("x-token-id", out var tokenId))
    {
        if (await _openIddictService.ValidateTokenId(tokenId))
        {
            return NoContent();
        }
    }

    return BadRequest();
}

ValidateTokenId 的实现

public async Task<bool> ValidateTokenId(string tokenId)
{
    var status = await _dbContext.Set<OpenIddictEntityFrameworkCoreToken>()
        .Where(t => t.Id == tokenId)
        .Select(t => t.Status)
        .FirstOrDefaultAsync();
    return status == Statuses.Redeemed || status == Statuses.Valid;
}

（二）

客户端（基于 ASP.NET Core 内置的 OpenIdConnect 实现的 Relying Party）实现一个 CookieAuthenticationEvents，在已登录的用户每次请求时检查 token id，如果 token 已经失效，自动登出当前用户。

public class CnblogsCookieAuthenticationEvents : CookieAuthenticationEvents
{
    public override async Task ValidatePrincipal(CookieValidatePrincipalContext context)
    {
        var identity = context.Principal.Identity;
        if (!identity.IsAuthenticated)
        {
            return;
        }

        var sp = context.HttpContext.RequestServices;
        var httpClientFactory = sp.GetRequiredService<IHttpClientFactory>();

        var tokenId = context.Principal.Claims.FirstOrDefault(c => c.Type == "oi_tkn_id")?.Value;

        if (!string.IsNullOrEmpty(tokenId))
        {
            using var client = httpClientFactory.CreateClient();
            client.BaseAddress = new Uri("https://account.cnblogs.com/");
            using var request = new HttpRequestMessage(HttpMethod.Head, "openiddict/validate-token-id");
            request.Headers.Add("x-token-id", tokenId);
            using var response = await client.SendAsync(request);

            if (response.StatusCode == HttpStatusCode.BadRequest)
            {
                context.RejectPrincipal();
                await context.HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
                return;
            }
        }

        await base.ValidatePrincipal(context);
    }
}

在 AddCookie 时注册上面的实现

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.EventsType = typeof(CnblogsCookieAuthenticationEvents);
    });

（搞定）