Question about security and the Xforms

Hi, I don't see anything about security  (outside section 11.2) etc. in
XForms.

Should it be possible to load/save instance data to the clients local drive?
What about using a URI/URL that points to a local resource?
Should you be able to "sign" a form similar to sign a JS in mozilla?

Is / should this be outside of the XForms spec?

Thanks

Justin