Expand on some topics in the body.

Provide a sketch of an introduction, and raise the distinction between
"trusted" (can break the security guarantee) and "trustworthy" (is unlikely
to break the security guarantee).