Note only VDAFs without aggregation-ordering requirement are supported.

draft-ietf-ppm-dap.md

@@ -570,7 +570,9 @@ DAP is extensible in that it allows for the addition of new cryptographic
 schemes that compute different aggregation functions. In particular, the
 aggregation function is determined by the Verifiable Distributed Aggregation
 Function, or VDAF {{!VDAF=I-D.draft-irtf-cfrg-vdaf-12}}, used to securely
-compute it.
+compute it. This protocol only supports VDAFs which require a single collection
+to provide useful results, and whose aggregation results are independent of the
+order in which measurements are aggregated (see {{Section 4.4.1 of !VDAF}}).
 
 VDAFs rely on secret sharing to protect the privacy of the measurements. Rather
 than sending its measurement in the clear, each Client shards its measurement
@@ -584,10 +586,6 @@ Aggregators. This scheme has two important properties:
   their shares locally into "aggregate shares", which may later be combined
   into the aggregate result.
 
-Note that some VDAFs allow measurements to be aggregated multiple times,
-each time with a different aggregation parameter; however, DAP only allows each
-measurement to be aggregated once.
-
 ## System Architecture {#system-architecture}
 
 The overall system architecture is shown in {{dap-topology}}.