Secure contexts non-normative introduction #118

I'm currently updating the MDN guide to secure contexts, and I had a couple of questions about the spec, and in particular, the non-normative introduction.

First, the intro says this about framed documents:

Framed documents can be secure contexts if they are delivered from potentially trustworthy origins, and if they’re embedded in a secure context.

Why "potentially trustworthy origins", not "potentially trustworthy URLs"? As far as I can see, the definition only refers to potentially trustworthy URLs:

If the result of Is url potentially trustworthy? given environment's top-level creation URL is "Potentially Trustworthy", then return true.

Second, the intro says this about dedicated workers:

They’re secure contexts when they’re delivered from potentially trustworthy origins, only if their owner is itself a secure context

In the definition, I don't see any requirement that they must be delivered from a potentially trustworthy origin:

If global is a WorkerGlobalScope:

• If global's owner set[0]'s relevant settings object is a secure context, then return true.