Relationship between E2EE implementation guide and the spec unclear

Nobody has claimed this yet.

It currently seems unclear where the line of scope is drawn between the [E2EE guide](https://matrix.org/docs/matrix-concepts/end-to-end-encryption) and the [spec](https://spec.matrix.org/latest/).

Usage of libolm functions feels like a good case for the guide as these are an implementation of the spec. On the other hand, the guide contains additional recommendations for how to securely implement E2EE. These seem better suited for the spec because we can use normative wording there to ensure that Matrix' security guarantees are in fact upheld in complying implementations.

One example of this are the steps for verifying decrypted Olm messages. In the guide these read like advice ("should"). However, the steps also exist in the [spec](https://spec.matrix.org/v1.17/client-server-api/#validation-of-incoming-decrypted-events) where they are REQUIRED.

Other recommendations from the guide such as storing a flag to remember encrypted rooms and preventing a MITM from disabling encryption again don't seem to exist in the spec at all but possibly should?

Compare the E2EE implementation guide with the linked Matrix spec, especially the sections on libolm usage and validation of incoming decrypted events. Identify which guidance is normative, which belongs in the guide, and which recommendations are absent from the spec. Done means the scope boundary and any required spec or guide changes are agreed and documented.

Written by the indexing model from the issue text.