Incorrect Info in Security Consideration Section

[hannestschofenig]

For example, Issuers must remove
Personally Identifiable Information (PII) as clear text in the
Statement. Alternatively, Issuers may include opaque cryptographic
Statements, such as hashes.

The identity of the issuer is included in the signed statement. As such, the example is not great.

[SteveLasker]

The doc has transistioned over time to now reflect the definition of the TS is to only store hashes of the signed statements, and the storage of the signed statements, receipts in other ancillary services is outside the drafts scope.
The doc needs a scrub to reflect the separation so sentences like this can have the proper context.

Update PII text to reflect the separation of persistence, and ability to use the cose-hash-envelope