Fix mrdewitt's comments.

draft-yasskin-dispatch-web-packaging.md

@@ -31,8 +31,8 @@ informative:
 --- abstract
 
 Web Packages provide a way to bundle up groups of web resources to
-transmit them together. These bundles can then be signed to establish
-their authenticity.
+transmit them together. These bundles can be signed to establish their
+authenticity.
 
 --- middle
 
@@ -60,8 +60,9 @@ Use Cases    {#use-cases}
 People with expensive or intermittent internet connections are used
 to sharing files via P2P links and shared SD cards. They should be
 able to install web applications they received this way. Installing a
-web application requires a TLS-type guarantee that it came from and
-can use data owned by a particular origin.
+web application requires a guarantee of the same kind as an HTTPS
+connection that it came from and can use data owned by a particular
+origin.
 
 ### Snapshot packages
 
@@ -249,8 +250,6 @@ index = [* [resource-key: http-headers,
             ? length: uint] ]
 
 ; http-headers is a byte string in HPACK format (RFC7541).
-; The dynamic table begins empty for each instance of
-; http-headers.
 http-headers = bstr
 ~~~~~
 
@@ -370,7 +369,8 @@ For each element *signature* of `signatures`:
 1. Let *certificate* be `certificates`\[*signature*\["keyIndex"]].
 
 1. The parser MUST define a partial function from public key types to signing
-   algorithms, with the following map as a subset:
+   algorithms, and this function must at the minimum include the following
+   mappings:
 
    RSA, 2048 bits:
    : rsa_pss_sha256 as defined in Section 4.2.3 of {{!TLS1.3}}
@@ -396,7 +396,7 @@ For each element *signature* of `signatures`:
 
 Let *origin* be `manifest`\["metadata"]\["origin"].
 
-Try to find a certificate in *signing-certificates* that has an identity
+Iterate through *signing-certificates* until one is found that has an identity
 ({{!RFC2818}}, Section 3.1) matching *origin*'s hostname, and that is trusted
 for serverAuth ({{!RFC5280}}, Section 4.2.1.12) using paths built from elements
 of `certificates` or any other certificates the parser is aware of. If no such
@@ -419,13 +419,6 @@ a [resource](#resource) within the `indexed-content` section. The sub-package's
 resources are not otherwise distinguished from the rest of the resources in the
 package. Sub-packages can form an arbitrarily-deep tree.
 
-There are three possible forms of dependencies on sub-packages, of which we
-allow two. Because a sub-package's manifest is protected by its own signature,
-if the main package trusts the sub-package's server, it could avoid specifying a
-version of the sub-package at all. However, this opens the main package up to
-downgrade attacks, where the sub-package is replaced by an older, vulnerable
-version, so we don't allow this option.
-
 ~~~~~ cddl
 subpackage = [
   resource: resource-key,
@@ -436,6 +429,13 @@ subpackage = [
 ]
 ~~~~~
 
+There are three possible forms of dependencies on sub-packages, of which we
+allow two. Because a sub-package's manifest is protected by its own signature,
+if the main package trusts the sub-package's server, it could avoid specifying a
+version of the sub-package at all. However, this opens the main package up to
+downgrade attacks, where the sub-package is replaced by an older, vulnerable
+version, so we don't allow this option.
+
 If the main package wants to load either the sub-package it was built with or
 any upgrade, it can specify the date of the original sub-package:
 
@@ -449,7 +449,7 @@ sub-packages with common dependencies, even if the sub-packages were built at
 different times.
 
 If the main package wants to be certain it's loading the exact version
-of a sub-package that it was built with, it can constrain sub-package
+of a sub-package that it was built with, it can constrain the sub-package
 with a hash of its manifest:
 
 ~~~~~ cbor-diag
@@ -460,8 +460,30 @@ with a hash of its manifest:
 
 Note that because the sub-package may include sub-sub-packages by date, the top
 package may need to explicitly list those sub-sub-packages' hashes in order to
-be completely constrained.
+be completely constrained. For example, if `loginsdk.package` has subpackages
+of the form:
+
+~~~~~ cbor-diag
+[
+  [32("https://other.example.com/helper.package"),
+   {"notbefore": 1(1486429554)}]
+]
+~~~~~
+
+the top-level package needs to specify:
+
+~~~~~ cbor-diag
+[
+  [32("https://example.com/loginsdk.package"),
+   {"hash": {"sha256":
+        b64'9qg0NGDuhsjeGwrcbaxMKZAvfzAHJ2d8L7NkDzXhgHk='}}],
+  [32("https://other.example.com/helper.package"),
+   {"hash": {"sha256":
+        b64'SG2GjbrpfVCh21HPLMIXD17fHNCst1Gz/MbQOqihG68='}}]
+]
+~~~~~
 
+in order to completely constrain all the versions of its dependencies.
 
 ## Parsing a resource {#resource}