I had a different set of criticisms, such as: mandatory TLS, no file size in the response, no range requests, etc. (I made up my own in order to address these and some others.)
And about the lack of file size: I proposed a way to sneak it in, and it was rejected outright. Oh well.