It would be nice to add a sample with two links and sample with two languages for the same link.
Would be xml:lang srme as body.
For the Security Considerations it should be mentioned that this can be used for phishing: you are sending a link to a fake site but the thumbnails and metadata will say "This is your bank". Another one problem is that the image URL can be used for tracking so that when a client tries to fetch it an attacker will see IP of a receiver.
Yes. The XEP already mentions both of these.
The sample has a lot of images and it may be not clear which one to support:
Any or none. They are just examples.
And last question: do we have any implementation of the XEP? I may add it to the Spark (Java+Smack) to test the specification and provide a feedback. But if this was already implemented I would rather see it in action.
Yes, Cheogram Android, Monocles, and Cheogram WWW all have it. And Gajim in at least nightly.