Create a Threat Model for Quantum Safe Data Integrity Cryptosuites

[msporny]

The specification needs a threat model for VC Barcodes before we can get horizontal review.

[Wind4Greg]

@msporny DI-Quantum-Safe doesn't require a "new" threat model different from a VC-Data-Integrity threat model which would be the "embedded" proof subset of the general Threat Model for Decentralized Credentials. The DI-Quantum-Safe security considerations section can discuss the fact that the algorithms are relatively new compared to classic signature algorithms, but it doesn't seem to warrant a separate threat model to me.

[msporny]

W3C is switching over to using threat model documents. We might be able to argue that the quantum safe stuff doesn't need it, but I expect we'll need a threat model for DI for v1.1. We can ask them specifically, but I expect the answer will be that we need one. I'd rather not go back and forth for months like we did before and we just get the threat model for DI done, and then extend quantum safe off of that. We can discuss on the next call.