Section 8.2 is marked as non-normative summary of "some of the mitigation strategies specified in the normative sections of this specification." Would you add links back to the normative text for each mitigation?

Ideally, please also split security and privacy concerns into separate sections, as requested in the current questionnaire.