Hello,

I have reviewed this document as part of the security directorate’s ongoing
effort to review all IETF documents being processed by the IESG. These
comments were written primarily for the benefit of the security area
directors. Document editors and WG chairs should treat these comments just
like any other last call comments.

Summary: Has Nits

The security considerations section looks great.
I just have a couple of remarks, easy to fix, on the form, not the content:

- the CIA classification is often fine, but not always.
Here, the discussion of section 5.3 "Integrity" is more related to access control than integrity.
I'm not convinced by the sentence: "However, the focus is [...] than the integrity of the service provider" that tries to justify why it could fit in a section on Integrity.

- the last item of section 5.4, namely "* Actors may face challenges...", is totally disconnected from DoS prevention or mitigation. It could be moved out of the itemize list and discussed as an independant paragraph.


Regards,    Vincent