README: add timing attack note

Closes #7