The naive reader would come away from this believing that EVERY "OGSA service" would have EVERY outbound or inbound  
message be mutually authenticated, with integrity checks, and confidentiality. This is a ridiculous requirement for a 
distributed system. 

If the authors intend that all messages do indeed have these properties, this document is misguided and overkill. If the
 authors do NOT intend that all messages have these integrity checks and confidentiality, then this should be made 
clearer in the document.