This section should also mention that as a result, applications need to verify that the tag they get is the expected length, so users can't unilaterally lower security margins.