Clarify the conditions for the Secure state

It's worth being clear that the current call will go Secure when the
local user only verifies the SAS.
Clarify the origin of the Not Secure name

We mean "not secure" in the logical sense that the call is other than
secure, not that we know conclusively that the call is compromised.