I know that X- was historically used as a convention for non-standard headers, which is now recommended against. These days I’m seeing more and more headers which start with Sec-, such as Sec-WebSocket-*, Sec-CH-UA, Sec-Fetch-*, and now Sec-GPC. However, I can’t find an any RFC which specifically discusses this convention. So, where did this convention come from, what does it stand for (Secure?), and what is its purpose?