I just created a test with the following request:

:test_bob_r_o_req a http:RequestMessage ;
    http:method "DAHU" ;
    http:requestURI </test-auth/alice_share_bob_r.txt> .

NSS returns 400 while I expected 405.

I think it is good practice to return a 405 for methods you do not implement, since it tends to be trivial to do and affords the client with more details to adjust its interactions. The RFC is more relaxed on this topic than I tend to be though. The question is if we should say something normative about it, and if so, should that normative statement be a MUST?