I could see some value in meta-data for automated reporting of security issues.

But the spec would have to be less informal.