Add IANA section.
Don't limit the passive observer to GSS-API initiatior<->observer traffic.
RADIUS proxies always have access to EAP MSK.
Add a note on client fingerprintability based on TLS session resumption.

Thanks to Jim Schaad for pointing this out.
Also, bump versino and date.