Original text:
5. The Privacy Pass issuance protocol is a two message protocol that <del> takes as input a challenge from the redemption protocol and produces a token, as shown in the figure below. </del>  Issuers provide a Private and Public Key, denoted skI and pkI, respectively, used to produce tokens as input to the protocol.  See computed as described in issuer-configuration. Challenge value "challenge", an opaque byte string.  For example, <del> this might be provided by the redemption protocol in HTTP- Authentication. </del>  Given this configuration and these inputs, the two messages exchanged in this protocol are described below.  This section uses notation computed as described in public-issuer-configuration. Challenge value "challenge", an opaque byte string.  For example, <del> this might be provided by the redemption protocol in HTTP- Authentication. </del>  Given this configuration and these inputs, the two messages exchanged in this protocol are described below. The rsabssa_finalize function is defined in BLINDRSA, Section 5.1.3.. If this succeeds, the Client then constructs a Token as described in <del> HTTP-Authentication as follows: </del>  The Token.nonce value is that which was sampled in private-request. If the rsabssa_finalize function fails, the Client aborts the 8.2. <del> This document updates the "Token Type" Registry with the following values. </del>  8.3.

Reviewer comments:
There's and . I'm guessing these should be collapsed to just one.
table 2 says: -- | -- and Section 8.1 says: What is the Token Type registry and what are the constraints on values in the registry? It's implied that values should be integers but JSON numbers are quite flexible, so would it be valid for me to register e.g. a negative integer. If the "Token Type" registry already exists, I'm not able to find it and a link would be useful. If it doesn't exist and this document wishes to create it, then more work is needed to establish that registry and it's procedures.
We're missing a link to the HTTP auth document, where the registry is defined. Good catch!

Revised text:
5. The Privacy Pass issuance protocol is a two message protocol that  <ins> takes as input a TokenChallenge from the redemption protocol AUTHSCHEME, Section 2.1 and produces a Token AUTHSCHEME, Section 2.2, as shown in the figure below. </ins> Issuers provide a Private and Public Key, denoted skI and pkI, respectively, used to produce tokens as input to the protocol.  See computed as described in issuer-configuration. Challenge value "challenge", an opaque byte string.  For example,  <ins> this might be provided by the redemption protocol in AUTHSCHEME. </ins> Given this configuration and these inputs, the two messages exchanged in this protocol are described below.  This section uses notation computed as described in public-issuer-configuration. Challenge value "challenge", an opaque byte string.  For example,  <ins> this might be provided by the redemption protocol in AUTHSCHEME. </ins> Given this configuration and these inputs, the two messages exchanged in this protocol are described below. The rsabssa_finalize function is defined in BLINDRSA, Section 5.1.3.. If this succeeds, the Client then constructs a Token as described in  <ins> AUTHSCHEME as follows: </ins> The Token.nonce value is that which was sampled in private-request. If the rsabssa_finalize function fails, the Client aborts the 8.2.  <ins> This document updates the "Token Type" Registry from AUTHSCHEME, Section 5.2 with the following values. </ins> 8.3.