Encouraging implementers to implement normatively-defined things is weird. If they are normative then implementations should be doing them. This section probably needs a larger rewrite given that implementations currently do not inform the user when the API is in use either, or provide a mechanism to disable it.

Thanks, yes indeed. I think it is clearer to simply remove the sentence starting with "Implementers are encouraged to ...".

And, considering the intent of this specification update is to specify what is currently implemented, the appropriate RFC 2119 term to use in this context is MAY. If implementations agree to add these additional mitigations, we will adjust the term accordingly.

These fixes are at 1304787