I think it's way too early and that yes, out-of-band knowledge about
what the serviceURL means is all we have right now. I'm willing to add
a paragraph that says this, if you think it worthwhile.

I agree Rich.

I think it would be worthwhile to communicate some of this issues in the prose and perhaps state that these issues can be resolved out-of-band between sender and receiver.   That would leave the door open to a future Note regarding in-band resolutions and/or best practice guidelines because in-band policy would not be normative.

-Matt