Thanks both of you. I'll go ahead and add the canonicity requirement to the spec.

Updating ssb-ref to use stricter checks will make sbot reject noncanonical base64 I think.

CC @Dominic