Consider moving §3 Threat Models to an appendix

[hober]

(with my TAG hat on)

The primary purpose of this document is the questionnaire; it should "get to the point" as quickly as possible. These threat model definitions are important background information and should remain in the document, but as back matter that readers may refer to while they answer the questionnaire.