Add scoping language related to matching and consent. (#89)

index.html

@@ -134,6 +134,14 @@ <h2>
       <li>Requesting a [=digital credential=], including mechanisms for secure
       presentation.
       </li>
+      <li>Ensuring that when an API call is made, the website does not learn
+      anything about the a holder's [=digital credentials=] or their software
+      unless the [=user agent=] has previously received user consent.
+      </li>
+      <li>Ensuring that any installed application software will not learn anything
+      about a given [=request=] unless the [=holder=] explicitly consents to use that
+      software.
+      </li>
     </ul>
     <p>
       The following items are out of scope: