Can you share where in the spec it says that? (I couldn't find it)

I could not, either, but Adam did. :)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f24199ed239ab9318beedb5534798285a6ef04b8

commit f24199ed239ab9318beedb5534798285a6ef04b8
Author: Adam Langley <agl@chromium.org>
Date: Wed Apr 04 19:04:55 2018

//device/fido: check that EC public keys start with 0x04.

The spec says that they have to, but we weren't checking it from what I
can see.

Bug:  827574 
Change-Id: I96f1a7b5078cfc4c5e88647f47e3a60821901848
Reviewed-on: https://chromium-review.googlesource.com/982632
Commit-Queue: Adam Langley <agl@chromium.org>
Reviewed-by: Balazs Engedy <engedy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#548146}
[modify] https://crrev.com/f24199ed239ab9318beedb5534798285a6ef04b8/device/fido/ec_public_key.cc
[modify] https://crrev.com/f24199ed239ab9318beedb5534798285a6ef04b8/device/fido/ec_public_key.h