Should the allowlist be explicitly public?

[Sauski]

The list of sites which are provided this information is a key mitigation against abuse - I would expect that such a list is publicly auditable to ensure it is actually achieving that mitigation.

There is some prior art in this space, with the list of Related Website Sets and Private State Token issuers publicly available.

[eladalon1983]

Thanks, these are great precedents, and will come in very useful!

Do you happen to know if there might also be precedents of such lists, which are used (and possibly also maintained) by multiple browsers?