Summary: IMHO, this draft is in good shape. It is clear and easy to read.

Major issues: None

Minor issues: None

Proposal:
It would be helpful for the reader if more explanation can be added to the following text in the “Security Considerations” section: 

“While there is limited protection against this, an operator monitoring the PCEP sessions can detect the use of vendor-specific
information, be aware of the decoding mechanism for this information, and stay vigilant for potential misuse.”

=> Agree always good to stay vigilant. But on what basis the operator can detect the potential misuse to prevent potential harm?