Make OHTTP reference normative, using RFC 9458.

Co-authored-by: Ted Thibodeau Jr <[email protected]>

Author: msporny

index.html

@@ -803,9 +803,9 @@ <h3>Generate Algorithm</h3>
       <p>
 [=Issuers=] SHOULD publish status list credentials in a way that can be cached
 and that does not track who retrieves the status list credential, such as
-through [[[?OHTTP]]], a content distribution network that is not operated by the
-[=issuer=], or by using business processes such that the access logs are not
-accessible to data analysts or systems administrators.
+through [[[RFC9458]]], a content distribution network that is not operated by
+the [=issuer=], or business processes for which the access logs are not
+accessible by data analysts or systems administrators.
       </p>
 
     </section>
@@ -916,8 +916,9 @@ <h3>Validate Algorithm</h3>
       </p>
 
       <p>
-[=Verifiers=] SHOULD cache the retrieval of the status list and SHOULD use
-proxies that hide retrieval behavior from the [=issuer=] such as [[[?OHTTP]]].
+[=Verifiers=] SHOULD cache the retrieved status list and SHOULD use proxies
+or other mechanisms, such as [[[RFC9458]]], that hide retrieval behavior from
+the [=issuer=].
       </p>
 
       <p class="note" title="Issuer validation is use case dependent">