[WIP] Security policy

Looking for early feedback on the direction I'm going.

I'd like to make this a security policy that developers actually want to read.
As someone who knows SSL, etc., I'd feel more comfortable with s/SSL/TLS/ - it makes me believe that the author understands.