Redundant requirements for secondary certs on a non-control stream
The draft states both
The SERVER_CERTIFICATE frame MUST be sent on the control stream. A SERVER_CERTIFICATE frame received on any other stream MUST not be used for server authentication.
and
The SERVER_CERTIFICATE frame applies to the connection, not a specific stream. An endpoint MUST treat a SERVER_CERTIFICATE frame received on any stream other than the control stream as a connection error.
This seems a bit redundant. If you trigger a connection error, then you don't process the frame and so the "MUST not be used for server authentication" can't apply. Consider combining and condensing the requirement text.
Agreed, both of these requirements are basically stating the same thing. Will condense these.