[Extracted from Blair Dillaway's mail to the list.]

Some specific comments on Section 4:

-          C0400 – I have a problem with the wording ”CONSUMER SHOULD perform one or both of the following…”. If I 
remember correctly, TLS/SSL client authentication requirements are specified in a Server generated handshake message.  
So shouldn’t this be a consumer must support X.509-based authN when required by the server and must support authN using
 messaging security otherwise?