doc/threat.html: contacts learn about revocations

I don't really understand the group signatures stuff yet, but I think this is accurate?