[hirsin]

I could believe that being in 2.1 as a BCP,but if it's not it's a good idea to add it.

[tnzk]

I've checked 2.0 Security BCP, 2.1 draft and OIDC and none of them seemed to cover that. Perhaps I could be in ongoing discussion in the mailing list of 2.1? I only checked their GitHub issues and found nothing relevant.