Not that I'm an expert, but what I've implemented in the past has been in .htaccess, not defining privacy settings in EE, until now I've not given it much thought... This answer gives some light - what you've done is set it so cookies aren't sent back from that domain for the content generated by EE, but they will still be sent in the request, therefore failing the performance tests. Also remember that EE doesn't have any involvement in the static content - that's the server - the admin settings are only for content generated by EE - so if you had your CSS and JS files as templates, then this would be served by EE, otherwise if they're external files they're delivered directly from the server, not EE.
You don't have to have a separate domain to be able to deliver cookie-less content, the subdomain just assists in multiple domain calls (so multi-threaded requests). I read elsewhere that Google advises that it's only worth doing if you have more that 5 items - assuming images are delivered via the static, then it'll be worth it. As an example, if all your CSS is in one minified file and all your JS is in another, and the images were via a CDN, then there would be little point.
Opening http connections costs time, and it is not always the case
that opening more connections is efficient. Reducing the number of
resources is much more effective than just piling up lots of open HTTP
This article gives a good description of specifying the .htaccess to remove cookie from the relevant file requests - note this is irrelevant of domain and is fairly self explanatory:
RequestHeader unset Cookie
Header unset Cookie
Header unset Set-Cookie
The second code from that article refers to unset eTag:
Entity tags (ETags) are a mechanism to check for a newer version of a
unset pragma - I can't find a numpty guide by Googling, but all references go hand in hand with reducing the header and caching information, although I have read that this line doesn't explicitly state "don't cache the content", and elsewhere I've read some browsers may still assume. So might need
Header set Pragma "no-cache" instead of their suggested
Header unset Pragma.
This chunk I add to my .htaccess to set the browser caching time of certain files:
ExpiresDefault "access plus 2 weeks"
ExpiresDefault "access plus 2 days"
And if you want to compress certain files sent from the server (still in the .htaccess file):
# Insert filter
# Netscape 4.x has some problems...
BrowserMatch ^Mozilla/4 gzip-only-text/html
# Netscape 4.06-4.08 have some more problems
BrowserMatch ^Mozilla/4\.0 no-gzip
# MSIE masquerades as Netscape, but it is fine
# BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
# NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48
# the above regex won't work. You can use the following
# workaround to get the desired effect:
BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
# Don't compress images
SetEnvIfNoCase Request_URI \\.(?:gif|jpe?g|png)$ no-gzip dont-vary
# Make sure proxies don't deliver the wrong content
Header append Vary User-Agent env=!dont-vary
Note that the compression settings in EE are only relevant to the pages served by EE - templates. Not the external static/resource files.