Post #2630838

@heiglandreas@phpc.social you're right about that. It's scattered across multiple specs and best-practice documents rather than stated as one clean "here's how to trust an OP for a domain" rule.