mandate time related requirements?

[Sakurann]

Discussed on today's WG call: we should remove this table, and add text based on this text in VCI but making it a MUST:

Claims containing time-related information, such as issuance or expiration dates, SHOULD be either individually randomized within an appropriate time window (e.g., within the last 24 hours), or rounded (e.g., to the start of the day), to avoid unintended correlation factors.

Originally posted by @jogu in #165 (comment)

[Sakurann]

wg discussion: either not add this clause at all (aka keep it a should) or add clarification/conditioning statements that it is a MUST when "privacy is a concern"....

[jogu]

Discussed on today's EU call: "MUST" with a vague-ish condition of "privacy is a concern" is essentially the same as a 'SHOULD' so there was a consensus not to add anything to HAIP and just rely on the existing 'SHOULD' in VCI.

Hence tagging as 'pending-close' and will close in a week or so if no one objects.

[jogu]

Discussed quickly again on today's WG call; no further comments, and no comments since the last 7 days since we added pending-close so closing.