Thanks for the feedback, Antoine!
I incorporated all changes except a few minor notes:
* One comment you had said that we should distinguish "DEVICE" by saying "DEVICEs that conform to this security profile." If we did, I think we would have to change most (all?) instances in this section--I think it is far more effective to allow the composition text at the beginning make it clear: all of Section 7 is optional and must be applied in entirety.
* The case of an unsecure DEVICE and a secure HOSTED SERVICE is an unusual one, and in cases where it's used, I think we should classify that as a separate security profile entirely, instead of trying to accommodate it in this profile.
Everyone, please see the updated text. You may reply with the original text, or this one--if you haven't yet started reviewing, please use the latest version.
