In the security section it says:
--
It is important for event sources to properly authorize requests.
--

This should include subscription managers too.

The "EventSource" attribute is still defined - its dead.

Proposal:
Change the security sentence to:
It is important for event sources and subscription managers
to properly authorize requests.

and delete:
  <xs:attribute name="EventSource" type="xs:boolean" />
from the xsd.