Move threat model doc to GitHub

Move threat model doc to GitHub
You *need* to distinguish between active and passive compromise here. An attacker with root on the server has vastly different capabilities than an attack who's got the tor user but can't escalate, or an attacker who's seized the servers that are online but cannot log in, or an attacker who's seized the servers and powered them off or imaged the disks...