Crucially, the protocol does not mandate a single security configuration; it lets each application and asset issuer define their own security posture

This approach is problematic — security is only as strong as the weakest link