Cross-origin iframes with Document-Isolation-Policy are not cross-origin isolated #12

The explainer says a document with Document-Isolation-Policy gets access to APIs gated on cross-origin isolation whether or not its embedder delegated it.

The spec doesn't change HTML's cross-origin isolated capability, which requires the document to be allowed to use the "cross-origin-isolated" feature. That feature has a default allowlist of 'self', so a cross-origin iframe with Document-Isolation-Policy is never cross-origin isolated unless its parent delegates. That defeats the embedded widget use case.

Should these documents be exempt? And if so, should an explicit allow="cross-origin-isolated 'none'" still disable it?