security checks in [[DiscoverFromExternalSource]] don't match those described in the security section

[mkruisselbrink]

In https://wicg.github.io/WebOTP/#security-availability you describe a number of checks, yet the actual algorithm instead checks if the origin is opaque. As such it is unclear (to me) what the actual limitations for usage are.