Move threat model doc to GitHub

Move threat model doc to GitHub
Sounds good. I updated with a blurb about the recommendation we give sources in 0.3.