Move threat model doc to GitHub

Move threat model doc to GitHub
This is no longer true, since we changed the document interface to require login in the web application. Now they would also need the journalist's password, which I do not interpret as being part of their "property" (unlike their laptop or their two-factor device, which are examples of seizable property). All of this depends on how we define property and how the passwords are being stored - if the password is stored in a KeePassX database (which we recommend) which is unlocked on an unlocked machine, and that machine is seized? I think we need a better description between attacker capabilities and possible scenarios here.