Just a nit on this point - "Quick note on Microsoft's implementation: their first shot at it was buggy and caused the "None" policy to omit the SameSite cookie

Just a nit on this point - "Quick note on Microsoft's implementation: their first shot at it was buggy and caused the "None" policy to omit the SameSite cookie attribute altogether" This isn't a bug, just unfortunate naming and a lack of prescient engineers. When it was written, None was not a valid enum value (and frankly still isn't) and the default was Lax. To remove Lax, you set it to None in dotnet, which did the standard behavior at the time - emit nothing. If every framework implemented every random extension proposed to every standard, we'd be in a very messy world with half-baked and sometimes contradictory standards implemented. Special casing because it's Chrome doing the breaking change to the standard/Internet is not a precedent I want to see.