Federation endpoint is only for users based on that server

Author: tcpipuk

proposals/4133-extended-profiles.md

@@ -96,7 +96,9 @@ member events.
 ### Server-Server API Changes
 
 1. **GET `/_matrix/federation/v1/query/profile/{userId}/{key_name}`** will mirror the client-server
-   API changes to ensure profile information is consistently available across the federated network.
+   API changes to ensure profile information is consistently available across the federated
+   network. This endpoint must only accept requests for local users on the current homeserver, and
+   homeservers must only request a profile from the homeserver specified in that user's MXID.
 
 ### Capabilities