You sign the digest of the data and the authenticated attributes. I disagree with this statement. It doesn't help to disagree without giving reasons. The if and only if statement is not wrong. As my previous mail has stated.
Location is a hint for where the document is.
The fact that you update the document at a URL location will not allow you to repudiate the fact that you signed the document. I can cache the document locally and take that copy into court when attempting to enforce your signature.