Clarify that 'current-password' is valid for change forms.
Clarify that 'username' is a federated username.
Add a note about PendingCredential usage.
Clarify algorithm arguments.
Clarify ownership of pending credentials.
Warn against chooser leakage.
Insecure URL.
Password change is in-scope.
Add note about sign-up with local credentials.
Regenerate HTML.