Authenticating the network-provided resolver

[martinthomson]

Authentication of information presented by the network is particularly fraught. The current treatment doesn't really address this topic very clearly. The text even makes a bald assertion that is unattainable in many situtations, namely:

Authenticate that the DNS resolver is the one provisioned by the network

This needs to be more carefully phrased. There are cases where it is possible for a client to authenticate the network and the configuration information it provides, but this is not universal.

Any "requirement" here should be reduced in strength to "desiderata" or something weaker and more words need to be spent on explaining the limitations of any authentication.

[chris-box]

See also issue #8