- draft-11 base update (breaking, wire-compatible triple renames;
  non-empty locator thumbprint; is-runtime-updatable flag)
- profile-psa: Arm PSA psa-cert-num extension + CLI registration
- docs: draft-10 -> draft-11, verifier §9 -> §8.2 citation remap