So: is it a consensus or not? Does Mr. Igoe consider PM an "attack", even though his own employer does it?
I'm having trouble reconciling the two.
Also, from a political perspective, the effort to replace Igoe was hamstrung by the lack of anyone in the universe raising their hand and saying "I'm a respected cryptographer AND I want to punch myself in the face continuously for several years by chairing CFRG".
The less reverence the Internet has for the cryptographic wisdom of the IETF, the better off I think we all are.
JOSE also includes RSA PKCS1v1.5 signatures, which are deprecated (you should use RSA-PSS, which JOSE also documents).
It includes naive nondeterministic DSA, which should be deprecated in favor of deterministic DSA or something like Ed25519.
It doesn't include details you actually want about curve selection. (Also, P-521?!)
It includes encryption under RSA PKCS1v1.5 (encryption with v1.5 is even worse than signing under it) and AES-CBC, which is disfavored by cryptographers.
(My understanding of JOSE is cursory, at best, so I wouldn't be surprised to be corrected on any of these).
That said, the very fact that the RFC was published sends a very strong message to those contingents about the IETF's priorities, and I for one am very happy to hear it.
Why? It's extremely common for industry/standardization groups like the IETF to come to conclusions that are contrary to the position of one of its members, and it usually doesn't result in said member being expelled or falling on their sword.
Actually I agree with your statement.
Update: Formatting. (can't we get a preview, please?)