fixes with help from Alexey
SHOULD -> MUST for sha-256
Robert Sparks DISCUSS
metalinkhttp-21 final
IESG
changelog
IESG review
MUST not -> MUST NOT in the r770
Lars' COMMENT #1 and #2
Robert's DISCUSS #2