Currently in the spec we reject the PaymentCredentialInstrument icon if it fails the URL parser (https://w3c.github.io/secure-payment-confirmation/#sctn-steps-to-validate-payment-method-data, step 6), but do not check the scheme. There is a non-normative note in the member description (https://w3c.github.io/secure-payment-confirmation/#dom-paymentcredentialinstrument-icon), but the spec should normatively reject URLs with schemes that are not one of https, http, or data.

This should also apply to PaymentEntityLogo urls.