Did you read the spec? How would it be spying if the user dictates who gets what info from their did? It's the same as when alby asks you to sign a specific event.