This is a fairly small thing. I think there is a typo in model.sdf for v1.7 and v1.8.

https://github.com/ignitionrobotics/sdformat/blob/5182c0e679ea19da0dfd356e9821b2d146e23d2c/sdf/1.7/model.sdf#L14

I think the required="*" should actually be a required="0", since - as far as I know - it is not possible for a model to have multiple canonical links. If so, I can submit a patch.

Edit: The reason I think this is a typo is because @canonical_link defines the link to which __model__ is @attached_to, and having multiple @canonical_links would make it possible to attach __model__ to multiple links.