Move threat model doc to GitHub

Move threat model doc to GitHub
I agree. A seizure of the journalist's property does not imply access to the Document Interface. If the attacker wants this, he or she will need to also get the password and the two-factor authentication token (if this is stored on a phone, the attacker will also need to access said phone and generate the token). Should we take this section out for now?