"A payer may secure endpoints from which the DTR process will retrieve additional artifacts to support execution"

This has nothing to do with CDS Hooks links.  The expectations around security for retrieval of data from the payer should:

1. Be in the section of the specification that talks about data retrieval from the payer (starting with the DTR Questionnaire operation)
2. Be expressed as a SHALL (we need SMART app/EHR to payer communication to be secured all the time, so no reason to express this as a MAY
3. To be precise about exactly what interfaces will be used - i.e. that we're using the operation to retrieve the Questionnaire and/or search, create and update against DocumentReference

Please move this to the part of the spec that talks about EHR/app to payer communication and tighten the wording accordingly.