Rough draft threat model doc for bananaphone