Move threat model doc to GitHub

Move threat model doc to GitHub
clarify: the GPG public key