My impression is that we can't control Mac's bonding behavior, so we can't provide a function to let the website request bonding. Having a bond seems like it's always more secure than not having one, and the main downside of trying to bond would be that we might show a pin-entry dialog if that's the pairing method the devices negotiate. Showing that dialog on connection seems better than showing it when the first secure characteristic is accessed.
Allow the UA to bond while connecting.
Thanks, normative text LGTM. Please incorporate the change description as a spec note explaining why, and why not an API.
Add a note explaining why this is a UA option instead of an API.