Discussed in meeting. There is a potential downgrade attack possible because of the missing certificate.
But changing it now could introduce IOP problems.
Maybe just say that ECC certificates need to be returned.

Option require certificate when ECC and not used for current SecureChannel.

Can we please make this mandatory for the new Security-Enhanced profiles?

Risk: a downgrade attack can be triggered by putting bad certificates in the endpointdescriptions for high security policies.

Clients would only discover the bad certificate after choosing an endpointdescription. We need to dcoument what a client should do in this case:

1) Warn user that it is using a lower security because of a bad certificates (confirm/continue prompt?)
2) After establishing a securechannel call GetEndpoints before calling CreateSession to check if a MIM messed with the high security policies. If difference - report attack.
3) If same then continue with lower security policy.

Note: this only applies to client that actually attempt a fallback after certificate validation failure. Clients that always abort if the first choice has an invalid certificate would not have this risk.

Add a flow chart that shows the connection process with three paths:
green - no errors,
yellow - errors on first choice but not on second choice,
red - any material mismatch between endpoints returned after securechannel established and the set the client got with no security.