Overall, looks good. I just have a couple of questions that might not need any changes to the doc.

Section 5.2 says "SHOULD retrieve the updated protected resource metadata and use the new metadata values obtained" which makes sense for the values included directly in the metadata. For the URLs like jwks_uri though, is the client expected to retrieve those again even if the URL itself didn't change? Or does that not need to be specified?

What do you think about adding something to section 5.2 about redoing all validation (like checking the resource field and validating the signature in signed_metadata) before using new values? I'd hope that any implementations would do that without it being specified, but I could see some bugs if the code path for fetching initial values is different than the code path for updating values.