Security Considerations

I did some searching and haven't seen any past discussion on having an official Security Considerations section of this spec, so I thought I might suggest it.

One topic that would be good to include in such a section would be guidance around the processing of a presentation submission. Regardless of the transport, the Holder should never generate an automated response to a submission. This is obvious in the positive case where all the presentation requirements are met and there should be subject consent. It's a very important consideration in the negative case as well in order to prevent a "Presentation Profiling" attack.

If a Verifier has the ability to selectively interrogate and profile the Holder by initiating multiple presentation exchanges with specific requirements, it will defeat the purpose of privacy protection and leave the Holder vulnerable to correlation and tracking.