[Uta] MTA-STS and HTTP cache control

[Daniel Margolis <[e-mail]>]

For the policy caching, we deliberately chose not to use HTTP Cache-Control
headers and, instead, use "max_age" in the response body because it avoids
the case where someone is hosting a policy on a general purpose HTTP
endpoint that has some other cache settings than they are aware of. (For
example, I may have an existing website at www.example.com, and I choose to
redirect policy.example.com to www.example.com; I may, additionally, have a
site-wide setting for Cache-Control that I do not have the ability to
change.)

However, by the same logic, it's unclear to me if we should specify to
implementors what their client behavior should be with respect to
Cache-Control--should they honor it as per RFC 7234? Should they never
cache?

As-is, it's up to the sender to cache or not cache (as with any HTTP
client), and thus policy publishers have to be a little careful and
remember that during a forced policy refresh the sender may see an old
policy file up until the Cache-Control forces them not to cache it.

It seems somewhat easier to me to simply specify that HTTP caching should
never be used (i.e. aside from the long-lived policy cache). Any objections?