This text raises questions that need clarification:

In many cases, the Certificates used to establish the SecureChannel will be the Application Instance Certificates. However, some Communication Stacks might not support Certificates that are specific to a single application. Instead, they expect all communication to be secured with a Certificate specific to a user or the entire machine. For this reason, OPC UA Applications will need to exchange their Application Instance Certificates when creating a Session.

i.e. if the SecureChannel certificates are not Application specific does that mean any place in the spec that discusses the binding between the SecureChannel Certificate and the Session needs to bind to the Certificate passed in Create/Activate Session?

Could affect redundancy failover and session recovery logic.