Code change:
that it serves resources that require authentication.  This document proposes a new non-probeable cryptographic authentication scheme. <ins> Unprompted Authentication serves use cases in which a site wants to offer a service or capability only to "those who know" while all others are given no indication the service or capability exists.  The conceptual model is that of a "speakeasy".  "Knowing" is via an externally-defined mechanism by which keys are distributed.  For example, a company might offer remote employee access to company services directly via its website using their employee credentials, or offer access to limited special capabilities for specific employees, while making discovering (probing for) such capabilities difficult.  Members of less well-defined communities might use more ephemeral keys to acquire access to geography- or capability-specific resources, as issued by an entity whose user base is larger than the available resources can support (by having that entity metering the availability of keys temporally or geographically).  Unprompted Authentication is also useful for cases where a service provider wants to distribute user-provisioning information for its resources without exposing the provisioning location to non-users. </ins> There are scenarios where servers may want to expose the fact that authentication is required for access to specific resources.  This is left for future work.

Related discussion:
text: Based on
The draft could benefit from some example use cases up front in the introduction.
Concise Use Case Description: Unprompted authentication, as defined here, serves use cases in which the provider of a service or capability wants only "those who know" to access it while all others are given no indication the service or capability exists. The conceptual model is that of a "speakeasy". For example, a company might offer remote employee access directly via its website, or access to limited special capabilities for specific employees. Members of less well-defined communities might acquire metered access to geography- or capability-specific resources by an entity whose user base is larger than the available resources can support. Unprompted authentication is also useful for cases where a service provider wants to distribute provisioning information to its resources without exposing the provisioning location to non-users. Edits/Additions welcome
Version 2: Unprompted authentication, as defined here, serves use cases in which the provider of a service or capability wants only "those who know" to access the service or capability while all others are given no indication the service or capability exists. "Knowing" is via an externally-defined mechanism by which user identifiers (required here) are distributed. The conceptual model is that of a "speakeasy". For example, a company might offer remote employee access to company services directly via its website, or offer access to limited special capabilities for specific employees, while making discovering (probing for) such capabilities difficult. Members of less well-defined communities might acquire access to geography- or capability-specific resources by an entity whose user base is larger than the available resources can support (via that entity metering the availability of user identifiers temporally or geographically). Unprompted authentication is also useful for cases where a service provider wants to distribute user-provisioning information for its resources without exposing the provisioning location to non-users.
Version 3: Unprompted authentication, as defined here, serves use cases in which a site wants to offer a service or capability only to "those who know" while all others are given no indication the service or capability exists. The conceptual model is that of a "speakeasy". "Knowing" is via an externally-defined mechanism by which user identifiers are distributed.