Confirmed in draft 33.

Change "permitted" to "recommended" in line 483.

July 13 minutes discussion:
  - Sec.8.1.2: On mandating the use of mutual authentication
    - Latha's comment needs followup. Since Latha is not on the call,
      follow up by email and finalize at next Monday's call.
    - Agreed that this requirement is very restrictive.
    - This was discussed at the Security session at GGF14. The reason
      given for mandating it, is that the profile addresses
      inter-organization (server to server) interactions and that the
      expectation is that those interactions must be secured. If
      operating in some special environment it might be possible to do
      things differently but then interoperability is not the main
      concern.(?)
    - The concern with mandating this requirement is that it sets too
      high a bar, especially for existing middleware. Very few, if
      any, systems do this at the moment. (The mechanism of acquiring
      and validating credentials is the problem not their usage
      afterwards.) It seems overly restrictive and many people might
      not be able to comply to this profile because of this.
    - The consensus on the call was therefore to soften this
      requirement. Specifically to change the requirement from MUST to
      SHOULD (or possibly RECOMMENDS; semantically equivalent to
      SHOULD but slightly different nuance).