Our previous plan was to reserve only *.oauth.pinniped.dev but we changed our minds during PR review.