Security and Privacy considerations for Signatures

All,

As discussed at the interim, we’ve pushed up a PR to add security and privacy considerations for the signatures draft. Please review when you can:

https://github.com/httpwg/http-extensions/pull/1776 <https://github.com/httpwg/http-extensions/pull/1776>

And importantly, please help us expand this as necessary. Are there other attacks we should enumerate? Are there other aspects we should highlight? Are there other mitigations and tradeoffs that implementors should be aware of?

Thanks,

 — Justin