When a surveillance company (in this case Google) is leading the push, security against surveillance isn't on their list of requirements. In fact it's more of a

When a surveillance company (in this case Google) is leading the push, security against surveillance isn't on their list of requirements. In fact it's more of an anti-requirement, which escapes human judgement via design by committee or other anti-scrutiny technique. So then we end up with yet another insecure API that we've got to suffer for years as the browser makers who actually care about security painstakingly figure out how to mitigate the vulnerabilities in the original standard. And I'm all for focusing on technical security, but it's worth mentioning that the biggest most concentrated win would be making commercial digital surveillance illegal (ie the path the GDPR tries to head in). Imagine if large public companies had to make their revenue by honest means instead of working as advanced persistent threats.