From is hard because gateway might add it. The end user recipient, what level of authenticated information do they have about who the actual recipient. For this community, while security argues for the headers in the body, it's mainly about users, and not driven by security. The security document should be outside the base document, half of implementors disagree about what should happen with the message disagrees. The point of the date field is to prevent a replay attack.
Room is split.
Most people thought they would form an opinion after time. Yes, Derek will update 2. Payload format for presence information Need to encrypt or sign, need one. Will be discussed on list. These have nothing to do with each other.