The draft states both
The SERVER_CERTIFICATE frame MUST be sent on the control stream. A SERVER_CERTIFICATE frame received on any other stream MUST not be used for server authentication.
and
The SERVER_CERTIFICATE frame applies to the connection, not a specific stream. An endpoint MUST treat a SERVER_CERTIFICATE frame received on any stream other than the control stream as a connection error.
This seems a bit redundant. If you trigger a connection error, then you don't process the frame and so the "MUST not be used for server authentication" can't apply. Consider combining and condensing the requirement text.