I think that you replied to your own question by yourself:
The spec (10.8.2) doesn't say anything !!!
It means that it's not mandatory for sure. But as "All fields in the primary key class must be declared as public.", even in the case you'd provide getters and setters, the Container wouldn't use them: given the spec, the Container will access the fields directly, using reflection.
For CMP, a primary key must be set by the end of ejbCreate() method. Although it is not required, the benefit of having the getter and setter methods to access a primiary is to allow bean provider to validate the primary key.
I think your argument is questionable for design reasons (I mean that if you think of some business rules to be applied for validation, the persistence layer is not the right place). But it's not the point: you don't set the primary key yourself, the *Container* will do it for you. And as it won't call your setters anyway, any validation code you'd put in them would be useless by definition.