Change:
inserted in each certificate that is issued.  Unless certificates are governed by a vendor specific PKI (or trust program), certificates that indicate usage for document signing MAY include the id-kp- <del> documentSigning EKU extension.  This does not encompass the mandatory usage of the id-kp-documentSigning EKU in conjunction with the vendor specific EKU.  However, this does not restrict the CA from including multiple EKUs related to document signing. </del> <ins> documentSigning KeyPurposeId.  The inclusion of the id-kp- documentSigning KeyPurposeId does not preclude the inclusion of other KeyPurposeIds. </ins> 6. <del> The usage of id-kp-documentSigning EKU intends to prevent id-kp- emailProtection from being used for purposes other than email and id- kp-codeSigning used to sign objects other than binary codes.  This EKU does not introduce new security risks but instead reduces existing security risks by providing means to separate other EKUs used for communication protocols namely, TLS or S/MIME etc. in order to minimize the risk of cross protocol attacks. </del> <ins> The usage of id-kp-documentSigning KeyPurposeId is to provide an alternative to id-kp-emailProtection being used for non-email purposes and id-kp-codeSigning being used to sign objects other than binary code.  This extended key purpose does not introduce new security risks but instead reduces existing security risks by providing means to separate other extended key purposes used for communication protocols namely, TLS or S/MIME etc. in order to minimize the risk of cross-protocol attacks. </ins> <del> To reduce the risk of specific cross protocol attacks, the relying party or relying party software may additionaly prohibit use of specific combination of EKUs. </del> <ins> To reduce the risk of specific cross-protocol attacks, the relying party or relying party software may additionally prohibit use of specific combinations of KeyPurposeIds. </ins> While a specific protocol or signing scheme may choose to come up <del> with their own EKU, some may not have significant motive or resource to set up and manage thier own EKU.  This general document signing EKU may be used as a stop gap for those that intend to set up their own EKU or those who do not intend to set up an EKU but still would like to distinguish from other usage. Introduction of this id-kp-documentSigning EKU value does not </del> <ins> with their own KeyPurposeIds, some may not have significant motive or resources to set up and manage their own KeyPurposeIds.  This general document signing KeyPurposeId may be used as a stop-gap for those that intend to define their own KeyPurposeId or those who do not intend to set up an KeyPurposeId but still would like to distinguish document signing from other usages. Introduction of this id-kp-documentSigning KeyPurposeId does not </ins> introduce any new security or privacy concerns. 7. <del> This document requests that IANA make two assignments.  One for the id-kp-documentSigning object identifier (OID), as defined in ext, for the EKU from the "SMI Security for PKIX Extended Key Purpose" (1.3.6.1.5.5.7.3) registry.  Another for the id-mod-docsign-eku, as defined in Appendix A, for the ASN.1 module X.680 from the in the "SMI Security for PKIX Module Identifier" (1.3.6.1.5.5.7.0) registry. No further action is necessary by IANA. </del> <ins> This document requests that IANA make two assignments.  One assignment is for the addition of the id-kp-documentSigning object identifier (OID), as defined in ext, to the "SMI Security for PKIX Extended Key Purpose" (1.3.6.1.5.5.7.3) registry.  The other assignment is for the addition of the id-mod-docsign-eku ASN.1 module X.680 object identifier (OID), as defined in Appendix A, to the "SMI Security for PKIX Module Identifier" (1.3.6.1.5.5.7.0) registry.  No further action is necessary by IANA. </ins>

Discussion:
Try to used KeyPurposeId (or key purpose, key purpose identifier, etc.), to express more accurately. Add some changes, related with restrictive expression of document signing KeyPurposeId, etc.
on the section 4, it seems better to change some of "EKU" to "KeyPurposeId" or "EKU values" to highlight following. excluded EKUs procedures checks, whether EKU values contain some OID(KeyPurpiseId), or absence of EKU extension. permitted EKU procedures check, whether EKU values contain some OID(KeyPurposeId).
Current expression on "Excluded EKUs procedure " and "Permitted EKU procedure" seems unclear about whether that procedure prohibits or allows, existence of certain key purpose identifier in the extended key usage value (partial match), OR certain set of key purpose identifier is on key usage value(exact match). my intension was the former. I will review, and will fix that expression if it were unclear. In addition, I will add "restrictions set is derived and implemented from (or configured with) the policy to which the implementation conforms." to clarify policy handling by RP or implementer.