The spec should recommend that private rooms are E2EE

I'm really surprised we don't seem to say this, but: shouldn't we say that private rooms SHOULD (or even MUST) be E2EE?

Start by reviewing the Matrix specification's existing treatment of private rooms and end-to-end encryption. Determine whether the intended recommendation is SHOULD or MUST, then confirm that the normative wording and its scope are consistent with the rest of the specification. Done means the issue's proposed policy has a clear, accepted specification change.

Written by the indexing model from the issue text.