The "Doesn't prove" line under each check is the useful part. One extension for check 5: if a subdomain really does need the session, __Secure- is the fallback when __Host- is too strict. The browser still requires Secure and an HTTPS origin, but it allows Domain and Path, so you give up host-only scoping. At that point every subdomain is inside the trust boundary, which makes it worth checking for dangling DNS records on subdomains you no longer run, since a Domain-scoped cookie is sent to all of them.