I feel like there ought to be more to say about the specific cases handled in this doc, but they look sufficiently similar to others that I'm content with the reference to other docs' security considerations. I reviewed -08, which has been updated in response to other LC comments. There are some nits - I'll send those to the editor separately, though RFC Editor will also catch them.