Pete Resnick comment

The comment is:

"6.3.4 - No discussion of wildcard in this section. Does there need to
be?"

Because 6.3.4 is the section about SecurityBlock, I guess that "wildcard"
refers to wildcard certificate.  It is not possible to define a wildcard
RELOAD certificate because neither the reload URI or the rfc822Name
supports a wildcard, but under the current rules, there is nothing that
prevents adding a dns: to the SAN or a wildcard to the subject.

So, to remove ambiguity, I added a sentence that mandates to only use the
SAN identities defined, and to use an empty subject (as RFC 5280 does).