proposed for v1.03

This seems to be a mis-understanding.

The description of the Core Server Facet states:
"Server does not need to support encryption and signing of user identity tokens (This assumes the Server also supports a transport that provides security.)"

The transport that provides security is outside the scope of OPC UA.

Add text to explain that security shall be provided by a secure transport (like VPN) that is outside the scope of UA.

The description of the Core Server Facet has been enhanced. It now states:

The Core Server Facet does not require the encryption and signing of user identity tokens. This exception is made with the assumption that the OPC UA Server will use means outside the scope of OPC UA to secure the identity token so that it cannot be retrieved by sniffing the communication. One option would be a secure transport like a VPN.

Changed in version "OPC UA Part 7 - Profiles 1.04 Draft 01.docx"

reopened since we will change the resolution.
We will add text to the individual user tokens and nothing to the core server facet.

fixed in OPC UA Part 7 - Profiles 1.03 Draft 03.docx

Will be closed when the change has also been made in the database.

Agreed to changes in database.