Threat model

[snarfed]

Ideally include both traditional security factors and more human-centric user safety threat vectors.