Webauthn: Section 10: extensions are OPTIONAL

[samuelweiler]

Section 9 says all extensions are OPTIONAL; section 10 says the ones in this doc are RECOMMENDED. Per 2119, these are quite different terms. I propose that the section 9 text is correct (or else we make AppID RECOMMENDED and the others OPTIONAL).

None of this is about flagging these as informational - as I understand it, we're making the case that all extension text should be normative, enabled by all (or all but one) extensions being optional.

I think the discrepancy should be cleared before PR.

[YubicoDemo]

Section 10 of the spec should be changed to match the language in Section 9, specifically the word OPTIONAL:

1. Defined Extensions
   This section defines the initial set of extensions to be registered in the IANA "WebAuthn Extension Identifier" registry established by [WebAuthn-Registries]. These are OPTIONAL for implementation by user agents targeting broad interoperability.

This creates a single way we refer to deployment of extensions.

[jcjones]

Agreed with the above, marking section 10 as section 9 is.

[selfissued]

I suggest simply changing "These are RECOMMENDED for implementation by user agents targeting broad interoperability" to "These can be implemented by user agents targeting broad interoperability".

We already say they're OPTIONAL in section 9. We don't have to repeat that in Section 10.

Who's going to create a PR for this? No PR - no effect. ;-)

[jcjones]

PR #1076 open, @selfissued , thanks!