I believe much of this is already being addressed in Slack. though I thought I'd mention it here:

By removing the word "Federation", this document can now be interpreted as to cover all aspects of InCommon activities. The issue: what is "InCommon"? Is it operations under InCommon LLC's control? If so, I think that means InCommon Cert Service is, but eduroam is not... If the word "InCommon" does not refer to InCommon LLC, then we should define what it means here.

Regarding Cert Service, we outsource its entire operation to Sectigo. Isn't that the same as us outsourcing eduroam to anyroam? A compromise to Sectigo's infrastructure (including its management app) poses similar risks to the community as anything else we cover. I am not sure I understand the rationale to exclude Cert Svc when we are including eduroam.

Need to consider removing/replacing "participants" in this - are eduroam connectors participants?

eduroam connectors sign a connector agreement, not the InCommon PA. SP-only connectors sign a different connector agreement directly with Anyroam.

Create new governing language that is contract-agnostic, send to KXM for approval/adoption.