CAT can do the display-T&C job for those IdPs who use it
if we have “superglue” (backup NAPTR zone on eduroam.org), request routing will work regardless if admin wants to participate or not - then device config decides whether a connection attempt will happen (RCOI is configured or not)
corner cases around manual connection attempts by end users - those might authenticate users even if IdP did not tick the box
to prevent that: do not use superglue - every IdP has to set NAPTR records themselves. CAT could police this - if checkbox for OpenRoaming RCOIs is set, but NAPTR doesn’t exist, do not let admin configure
