The Security Considerations say "The main risk to be aware of is the impact of mismatched URLs", but nowhere in this document (or in any of the normative references) is a "mismatched URL" defined. I think this section needs to elaborate on what this is so the guidance can be understood.

However, the most significant issue is that the Security Considerations is seemingly written from the standpoint of a web browser. Given that non-browser technologies also may implement this specification, I would expect this section to contain guidance for other types of caches, especially shared caches.

A few other comments outside the Security Considerations:
1. Since Section 7 of this document replaces text in Section 4 of RFC 9111, I would expect that this document updates RFC 9111.
2. Section 5.3 scopes the algorithm to ASCII inputs ("To parse a key given an ASCII string keyString:"), but the examples in 5.3.1 all contain non-ASCII code points.