[security-services] Remarks on core-22

1. 
Appearance of "section 0" in printed text.
Should this somehow resolve to the actual
section number in printed text? Am I just 
printing this is some bad way?

2.
502-503

Shouldn't this read to say: It contains one or more
instances of one or both of the following elements:
...

My suggestion is based on the occurrence of 
maxOccurs=unbounded on line 517.


3.
549
should read:

<SubjectConfirmationData>[Optional]
...
based on schema fragment shown on 562.


4.
827-844

Processing model for <RespondWidth> is not specified.
Is this a hint to the responder? Or should the
responder fail if these constraints cannot be met?
I don't really have a strong opinion on the MUST
vs. MAY choice here but we need to call this out
someplace.

5.
839-841

Font issues


6.
918, use of ConfirmationMethod
573, use of AuthenticationMethod

There is some inconsistency here. My understanding
in earlier versions was that the filter was built around
AuthenticationMethod (otherwise why should it be
specific to <AuthenticationQuery>?). My guess is
that line 918 should read:

<AuthenticationMethod>[Optional]

7.

1029-1032
1149-1150

Remove <SingleAssertion>, <MultipleAssertion>

8.

1237 - Add the following text at end of sentence:

, or, possesses the secret key described by <ds:KeyInfo>

9.
1292: RFC in URN refers to RFC for CMS. I am not
sure which RFC is meant here.