Just picking up this old thread again...
There seemed to be general agreement to host the firmware hand-off spec in a separate repo with separate maintainers at TrustedFirmware.org, at least initially. Arm intends to progress with the initial population of this repo. We intend to use the CC-BY-SA-4.0 (https://spdx.org/licenses/CC-BY-SA-4.0.html) license, the same as used for EBBR (https://github.com/ARM-software/ebbr). Please say if you have any objections to this. We will also seek approval from the TrustedFirmware.org board.