Refine wording for validation of credential status

[scouten-adobe]

Per §9.3.5, “Validation of credential status,” refine discussion of validation of credentials status.

Some guidance is already provided in the validation section which can be referenced here.

[scouten-adobe]

@pblument I'd like to discuss the following two questions raised in §9.3.5, “Validation of credential status,” with you and arrive at guidance:

• What if the bad actor is in an ingredient and not the primary piece of content?
• What is displayed to the end-user in both the primary content and ingredient scenarios?

[scouten-adobe]

I split off the ingredient question into a (hopefully) post-1.0 item in #137.