Move threat model doc to GitHub

Move threat model doc to GitHub
I was hoping the person who wrote this line in the original document would comment and explain. I think it makes sense to focus on remote attacks, which means we would be talking about the likelihood of XSS and CSRF. Given that we assume the source is using the Tor Browser or Tails and also follows our recommendation to disable Javascript, a random person on the Internet would have a hard time stealing this information from the source's browser session. I'm not sure if that means we should just take this item out or rephrase it in some way.