adding an explicit note that integrity verification stops at an iframe's document source

The commit fixes #9, as discussed in our meeting yesterday.
Picking someone timezone friendly, can you review @mikewest?

*Note:* This pull request does not include an updated index.html, as I was unsure about [these warnings](https://dpaste-bkero.paas.allizom.org/Dhhp/raw) I got when generating.