I already reviewed version 9 of this draft. The changes since then include more precise syntax definitions, a list of examples, and an extended security section. The security extensions outline the issues with even read-only disclosure of sensitive information, which is a welcome addition to the draft. From a security point of view, this draft seems ready.