Should cryptoProperties only be specified for components of type cryptographic-asset?

[andreas-hilti]

ModelCard
https://cyclonedx.org/docs/1.6/json/#components_items_modelCard
has the following restriction:

This object SHOULD be specified for any component of type machine-learning-model and MUST NOT be specified for other component types.

Similarly, data
https://cyclonedx.org/docs/1.6/json/#components_items_data
has the restriction:

This object SHOULD be specified for any component of type data and MUST NOT be specified for other component types.

This makes me wonder whether the CryptoProperties:
https://cyclonedx.org/docs/1.6/json/#components_items_cryptoProperties
should have a similar restriction? Should they be specified only for components of type cryptographic-asset? The description kind of implies it, however, it is not explicitly specified.

[stevespringett]

Yes, for CycloneDX V1.7, I would like to enforce this. This would not be a breaking change since the documentation clearly states that those properties must not be used any other times.

[stevespringett]

#522 was created to track this change.