The WG published a document on Performance APIs, security and privacy.
We should revisit this doc to see if/how it needs to be updated, and whether we're still interested in working on it.

It may also be interesting to augment it with related principles around performance and reporting. (or put those in a separate document)